MediumExperience level: 3-5 years · 8-15 years1 min read

API keys vs OAuth2 vs JWT — when do you use each for API auth?

Reviewed by Gurusankar M.

Asked inAmazonMicrosoftGoogleDeloitte
#oauth2#jwt#api key#authentication#authorization
Report issue

Short Answer

API keys: simple service/server identification (no user context). OAuth2: delegated authorization — third parties act on a user's behalf without their password (access + refresh tokens). JWT: a token FORMAT often used as the OAuth2 access token. They're complementary, not competing.

On this page

Concept Made Simple

Coffee Chat Question

“API keys vs OAuth2 vs JWT — when do you use each for API auth?”

Remember It Faster

Mind Map Answer

API key
identify a service/app, simple
OAuth2
delegated authZ, access+refresh tokens
JWT
a token format (often the access token)

Think Beyond the Expected

What If?

Why are short-lived access tokens + refresh tokens better than one long-lived token?

A short-lived access token limits the damage window if leaked; the refresh token (stored more securely, revocable) mints new access tokens without re-login. You get both security (short exposure) and UX (no constant logins), plus a revocation point.

Real World

Typical setup: OAuth2 issues short-lived JWT access tokens + refresh tokens for user-facing apps, while server-to-server integrations use API keys or client-credentials OAuth — chosen by who the caller is.

Interviewer's Expectation

Keywords they're listening for:

  • API key = service identity
  • OAuth2 = delegated authZ
  • JWT = format not protocol
  • access vs refresh tokens
  • short-lived + revocation

Common Mistakes

  • Calling JWT an alternative to OAuth2
  • Long-lived access tokens with no refresh/revocation
  • Putting secrets/PII in the JWT payload

Best Practices

  • Short-lived access + refresh tokens
  • Use scopes for least-privilege
  • Validate signature, exp, audience, issuer

Follow-up Questions

  1. AuthN vs AuthZ — which does OAuth2 do?
  2. How do you revoke a stateless JWT?
  3. What is the client-credentials grant for?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Auth (REST APIs)
Interview question: "API keys vs OAuth2 vs JWT — when do you use each for API auth?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.