Table of contents
Always use TLSUse OAuth2 for single sign on (SSO) with OpenID ConnectUse API keys to give existing users programmatic accessEncourage using good secrets management for API keysChoose when to enforce authorization with request-level authorizationConfigure different permissions for different API keysLeave the rest of the authorization to the app/business logicIn summary: use good librariesSort: