API keys
Service-to-service or low-complexity access with explicit scope and rotation.
API AUTHENTICATION
Treat developer credentials as governed assets.
Scope, rotate, revoke and observe API credentials; use stronger identity flows when user or organisation delegation is required.
API AUTHENTICATION
Developer contract.
Scope, rotate, revoke and observe API credentials; use stronger identity flows when user or organisation delegation is required.
OAuth/OIDC
Delegated user/organisation access where appropriate.
Scopes
Least-privilege resource/action permissions.
Rotation
Creation, last-used, expiry, rotation and emergency revocation.
Observability
Request IDs, actor, scope, rate and error monitoring.
Secret handling
Never expose server secrets in client-side code or public repositories.
NEXT STEP
Discuss an integration requirement.
Production integrations require scope, identity, data classification, rate and support requirements.