While Part 1 covered authentication fundamentals and OAuth flows, this section focuses on how APIs validate tokens and enforce authorisation in real-world architectures.

Why API Gateways Are Important

API gateways act as the central entry point for API traffic. They provide several security benefits:

• Block direct internet access to internal services

• Validate tokens before requests reach APIs

• Enforce rate limiting and traffic filtering

• Provide centralised authentication and logging

In many architectures, the gateway functions as a Layer 7 security control.

Token Introspection

When APIs use opaque tokens, they cannot read token contents directly. Instead, they use token introspection.

The process works like this: The API gateway receives a token. It calls the authorisation server's introspection endpoint. The server returns token metadata such as validity, scopes, expiration and subject identity. This allows the system to verify tokens without exposing sensitive data in the token itself.

Phantom Token Architecture

A common modern pattern is the phantom token flow. In this design, external clients receive opaque tokens, while internal APIs use JWTs. Here is the process:

• Client sends opaque token.

• Gateway introspects the token with the authorisation server.

• The authorisation server returns a JWT representation.

• Gateway forwards the JWT to internal APIs.

Benefits include:

• Strong trust boundaries

• Better auditing

• Simplified API validation logic

Gateway vs API Authorization

Authorisation is typically divided into two layers.

• Gateway – Coarse-Grained Authorization
  The API gateway performs high-level access filtering. For example, you verify that a token includes invoice_read and then route requests to the correct API. This prevents obviously invalid requests from reaching backend services.

• API – Fine-Grained Authorisation
  The API performs detailed checks. For example, confirm scope matches the endpoint. Verify the user owns the resource. Then, validate claim values. Example logic: Does token include invoice_read? Does subscriber_id match the invoice owner?
  This layer enforces the actual business logic.

Scope Design Strategy

Scopes should follow a clear naming convention. Some example are Domain Scopes Invoicing: invoice_read, invoice_write; Streaming: video_stream, video_metadata; Device Management: device_read, device_update. Good scope design avoids scope explosion while maintaining clarity.

Risks of Excessive Token Claims

Adding too many claims to access tokens introduces several risks:

• Information Leakage
  JWTs are Base64 encoded, not encrypted. Anyone holding the token can read its contents. Sensitive data should not be included.

• Token Size Issues
  Large tokens increase request size and network overhead. This can impact performance, especially in mobile applications.

• Stale Authorisation Data
  Claims may become outdated after the token is issued. If user roles change, a previously issued token may still grant access. Short expiration times help mitigate this risk.

Best Practices for API Authentication

Secure API authentication involves multiple layers. Key practices include:

• Require JWT validation for all API requests

• Verify ISS, AUD, EXP, and signature

• Use TLS for all API communication

• Avoid hardcoded credentials

• Minimise token claims

• Keep access tokens short-lived

• Use gateways to enforce centralised controls

Key Takeaways

Secure API authentication requires more than simply issuing tokens. Strong API security requires proper OAuth flow selection, token validation, gateway enforcement, fine-grained API authorisation, and secure token design. When these components work together, APIs can securely support modern distributed systems.