A thought experiment exploring why client-side TLS certificates never became a mainstream alternative to OAuth for API authentication. The author sketches a hypothetical protocol where API clients register a CA with a service provider, generate per-user certificates during an authorization flow, and use those certificates to
Sort: