APIs for Product Managers
Authentication and Authorization, Explained Without Jargon
Authentication is "who are you." Authorization is "what are you allowed to do." Confusing the two costs companies real security incidents.
Concept | The question it answers | Common implementation | The PM angle |
|---|---|---|---|
Authentication (AuthN) | "Who is calling?" | API keys, OAuth tokens, JWTs | How painful is it for a new developer to get their first credential, and how fast? |
Authorization (AuthZ) | "What is this caller allowed to do?" | Scopes, roles, permissions | Have we actually defined the smallest set of permissions each partner needs, or did we just grant "full access" because it was easier to build? |
API keys are the simplest form — a long string a developer includes in every request, like a password for a robot. Simple to implement, but if leaked (accidentally committed to a public GitHub repo, which happens constantly), whoever finds it has full access until it's revoked. Good API products make key rotation and revocation a five-second self-service action, not a support ticket.
OAuth is the "log in with Google" pattern — it lets a user grant a third-party app limited access to their account without ever handing over their password. If your product lets other apps act on behalf of your users (post to their account, read their data), you almost certainly need OAuth, not a shared API key.
Scopes are the granular permissions inside an OAuth flow — "this app can read your calendar but not delete events." The product decision here is real: too few scopes and every integration needs broad, uncomfortable access; too many scopes and developers give up trying to figure out which ones they need.
THE COSTLY DEFAULT
The single most common security-adjacent product mistake: granting broad access because it's the path of least resistance during a rushed integration, with a mental note to "tighten it later." Later rarely comes, because tightening access after partners depend on the broad version is itself a breaking change — see Lesson 3.2.
YOUR MOVE THIS WEEK
Ask your engineering lead: "If a partner's API key leaked publicly right now, what's the blast radius — what could someone do with it, and how fast could we shut it down?" If the honest answer is "everything, and not fast," that's a finding worth escalating before it's an incident postmortem.