API security
API Key
An API key is a static application credential used to identify or authorize calls to an API.
Identity and Access Management glossary
Explore the concepts used across Identity and Access Management, Identity Governance, Access Management, privileged access, authorization and identity security.
Definitions are organized to support search and navigation between related concepts.
Search for a term
Browse by letter
Filter by category
Glossary terms
20 terms
- API security
Authorization Grant
An authorization grant is the protocol basis used by a client to obtain an access token from an authorization server.
- API security
Authorization Scope
An authorization scope is the declared perimeter of access granted to a client application or service.
- API security
Bearer Token
A bearer token is a token that grants access to whoever presents it successfully.
- API security
Client Credentials Flow
The client credentials flow is an OAuth pattern in which a client obtains an access token for its own technical identity rather than on behalf of an end user.
- API security
Confidential Client
A confidential client is a client application capable of keeping its own credentials protected during token acquisition.
- API security
Delegated Access
Delegated access is the model in which a user or system authorizes an application to act on its behalf within a controlled perimeter.
- API security
Machine-to-Machine Authentication
Machine-to-machine authentication is the verification of one application, workload, or service by another without human interaction.
- API security
OAuth 2.0
OAuth 2.0 is an authorization framework that allows an application to access a resource on behalf of a user or system without receiving the original password.
OAuth - API security
Proof-of-Possession Token
A proof-of-possession token is a token that can only be used by the holder that proves possession of an associated cryptographic element.
- API security
Refresh Token
A refresh token is a token used by an authorized client to obtain a new access token without replaying the full end-user interaction.
- API security
Resource Server
A resource server is the API or protected service that receives and validates access tokens before serving data or actions.
- API security
Secret sprawl
Secret sprawl is the uncontrolled distribution and duplication of secrets across systems, code, teams, and environments.
- API security
Service Identity
A service identity is a technical identity assigned to a service so it can authenticate and call protected resources.
- API security
Service Mesh Identity
Service mesh identity is the technical identity model used inside a service mesh to authenticate and secure east-west service communication.
- API security
Short-Lived Token
A short-lived token is an access token intentionally designed with a brief validity period to reduce reuse and compromise exposure.
- API security
Static Secret
A static secret is a credential that remains valid until manually changed rather than being short-lived or dynamically issued.
- API security
Token Introspection
Token introspection is the process through which a protected service checks the current status and properties of a token with a trusted authority.
- API security
Token Revocation
Token revocation is the invalidation of a token before its normal expiration time.
- API security
Workload Identity
A workload identity is the identity attached to a running application component, container, job, or compute workload.