API keys
A single long-lived secret sent with every request. Simple, but powerful — treat it like a password and never ship one to a browser.
Lesson 2 of 10
Auth
Most escalations that look like a broken integration are actually an identity or permission problem. Learn to tell the two apart quickly.
Identity vs. permission
Every auth failure is one of exactly two things. Naming which one first narrows the investigation immediately.
Authenticationanswers "who is this?" — it's the process of proving identity, usually via a credential like an API key, password, or token. Authorizationanswers "what is this identity allowed to do?" — it's checked after authentication succeeds. A request can be authenticated (the platform knows who you are) and still be unauthorized (you're not allowed to do that specific thing).
Mechanisms you'll see constantly
Different products reach for different tools, but they all reduce to identity plus permission.
OAuth 2.0
A framework for one system to get a scoped, time-limited token to act on behalf of a user or itself — without ever handling that user’s password.
JWT (JSON Web Token)
A compact, signed token format — header.payload.signature — often used as the access token OAuth issues. The payload carries claims like subject, scopes and expiry.
Scopes & roles (RBAC)
Scopes limit what a specific token can do; roles describe what a user account is allowed to do in general. A token can be scoped down even for a highly-privileged user.
Exercises
Look at the sanitized request and response below, then work through both exercises.
GET /v1/conversations/CH2a91 HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhY2N0XzQ0MiIsInNjb3BlIjoicmVhZDpjb252ZXJzYXRpb25zIiwiZXhwIjoxNzEwMDAwMDAwfQ.xyz
HTTP/1.1 403 Forbidden
{
"error": {
"code": "insufficient_scope",
"message": "Token has scope 'read:conversations', endpoint requires 'write:conversations'"
}
}Concept check
Answer in your head first, then click a question to reveal the answer.
Scenario checklist
Work through the sample request/response and check each item off. Progress is saved in your browser.
Go deeper
These primers are a starting point. Read the primary sources to build real fluency.
MDN: HTTP authenticationThe Authorization header, auth schemes, and the WWW-Authenticate flowOAuth 2.0The authoritative reference for grant types and terminologyJWT.io: Introduction to JSON Web TokensToken structure, claims, and how signature verification worksOWASP API SecurityCommon authentication and authorization risks to recognize
Training Notes
What building this project taught me.
The core diagnostic split is identity vs. permission
Almost every auth investigation reduces to one question: does this request have a valid identity at all (401), or does that identity lack permission for this specific thing (403)? Leading with that split keeps the lesson focused instead of turning into a tour of every auth standard.
Reused the HTTP lesson’s exercise shapes rather than inventing new ones
Once a pattern works — reveal-to-check for concepts, a persisted checklist for a scenario — repeating it for the next topic is more valuable than novelty. Each lesson gets its own storage key prefix (tse-auth-lesson-*) so progress never collides across topics.