200-901 · Question #482
A developer prepares an API to be used by administrators. API requires username and password to be verified for validated access to data, however username-password combination of users must not be sen
The correct answer is A. OAuth Authentication. Security: OAuth avoids sending passwords directly to the API. Instead, it utilizes access tokens issued by an authorization server, ensuring stronger security compared to Basic Authentication, which transmits credentials in plain text. Flexibility: OAuth supports various grant ty
Question
A developer prepares an API to be used by administrators. API requires username and password to be verified for validated access to data, however username-password combination of users must not be sent to the API service itself. Authentication and authorization will be provided over the same mechanism. Which authentication mechanism must be used by the API service?
Options
- AOAuth Authentication
- BDigest Access Authentication
- CBasic Authentication
- DAPI Key Authentication
How the community answered
(20 responses)- A80% (16)
- B5% (1)
- C10% (2)
- D5% (1)
Explanation
Security: OAuth avoids sending passwords directly to the API. Instead, it utilizes access tokens issued by an authorization server, ensuring stronger security compared to Basic Authentication, which transmits credentials in plain text. Flexibility: OAuth supports various grant types, enabling diverse authentication flows like authorization code grant (common for web applications) and client credentials grant (for machine- to-machine interactions). Authorization: OAuth combines authentication with authorization, allowing control over user access levels and specific data they can access. This goes beyond just verifying user identity.
Topics
Community Discussion
No community discussion yet for this question.