intermediate · security

API Keys or OAuth?

When is an API key enough, and when do you need delegated authorization like OAuth?

Practical scenario

A SaaS ships “integrations” by having users copy their account API key into each vendor's settings page, and one vendor's breach exposes full-access keys for 4,000 accounts.

What it tests

  • • Whose resources are being accessed — the caller's or a third user's
  • • Key lifecycle: scoping, rotation, revocation
  • • Understanding what OAuth actually adds beyond “more secure”