Authentication: API keys, OAuth, and JWT

Three ways to see it

1. 1

   The simplest scheme is the API key. The server gives you a long random string, you put it in every request, the server checks it. If it matches, the request is from you. An API key is like a single house key. Whoever holds it gets in. Lose it and the thief gets in too. Most government and corporate APIs in Pakistan still run on API keys: NADRA's verification API, FBR's data exchange endpoints, the State Bank's PRISM messaging gateways. The key sits in a header called Authorization with the word Bearer in front of it.

2. 2

   API keys have one fatal weakness. If your end user is a person, not another server, you cannot put the key in front of them. The browser would expose it to every prying eye. So the industry invented OAuth. OAuth is a dance between three parties: the user, the app, and the system holding the user's data. The user authorises the app, the system gives the app a temporary token, the app uses that token to act on the user's behalf. When you click 'Sign in with Google' or 'Connect to Easypaisa' inside a third-party app, you are inside an OAuth dance. The user never hands over their password. The third party never sees the password. Only the temporary token crosses, and the user can revoke it any time.

3. 3

   The State Bank's draft open-banking framework, on which Pakistan's future fintech industry rests, mandates OAuth 2.0. The model is exactly the same one that makes 'Sign in with Google' work. A new fintech wants to read your HBL balance to give you a budgeting view. You authorise HBL to share read-only access. HBL gives the fintech a token valid for thirty days, scoped only to balance and recent transactions. If the fintech misbehaves, you revoke the token from HBL's portal, not from the fintech itself. This is how a regulator builds an ecosystem that is both open and safe.

The why-tree

Try this with Claude

AI-edge prompt to try with Claude or ChatGPT: 'I am the IT head at a mid-size Pakistani bank. Walk me through the OAuth 2.0 authorisation code flow as if explaining to a board member. Use a use case where a fintech app wants read-only access to a customer's transaction history. Show what each party sees, what crosses the wire, and where the password lives. Cite the RFC.' Compare against RFC 6749.