Identity:The missing link in API security
summary
Identity becomes the enforceable link for authentication, authorization, throttling and auditing rather than just client secrets; the session shows concrete moves from client-only checks to OAuth 2.0 access tokens plus an identity token (JWT) for attribute-aware authZ, role/attribute-based and risk-based policies, and per-user throttles. Federation via SAML or modernized OpenID Connect prevents identity duplication, enables federated authN, token rotation and finer certificate/key rollover, and integrates audit trails for compliance.
AI-written summary · about
chapters (11)
- 0:00Introduction to API security
- 1:00Four elements of API security
- 3:28Identity-aware authentication
- 5:19Enterprise identity security
- 7:06Identity-aware authorization
- 9:03Throttling and identity
- 10:08Risk-based traffic control
- 11:16Identity-based auditing
- 12:25Modern identity standards
- 15:28OpenID connect future
- 17:34Summary and conclusions
related talks
27mIntegrating API Security Into A Comprehensive Identity Platform
36mTo Identity and Beyond
27mThe Nuts and Bolts of API Security: Protecting Your Data at All Times
32mSecuring Value in API Ecosystems
24mCriticality of identity: The importance of knowing who your API consumer is
01h 12mIdentity 2.0: the what, why and how of social and federated login
32mPlatform Security that will Last for Decades
18mOne Identity to Rule Them All