Api Design easy
Your API serves both mobile apps and third-party integrations. Which authentication method is most appropriate?
- A Use stateful session cookies tracked by the server.
- B Use OAuth 2.0 Bearer tokens for stateless authentication.
- C Use HTTP Basic Authentication with base64-encoded credentials.
- D Use IP whitelisting to restrict access to known networks.
Answer: B. Use OAuth 2.0 Bearer tokens for stateless authentication.
For APIs serving diverse clients (mobile, web, third-party), **OAuth 2.0** with **Bearer Tokens** is the industry standard. It provides a stateless, secure, and flexible mechanism for authorization. Session cookies are problematic for non-browser clients (like mobile apps), and Basic Auth is insecure for most use cases as it requires sending credentials with every request.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- You're designing a REST API for a blog. Which endpoint best represents 'get all comments for post 123'?
- A client wants to update only the 'status' field of an order, leaving other fields unchanged. Which HTTP method is most appropriate?
- A client calls POST /users with valid data, and the user is created. What status code should the server return?
- A client retries a failed 'POST /payments' request due to network timeout. The server receives the request twice. Without idempotency handling, what can happen?
- An API returns 10,000 products. Returning all in one response is impractical. Which pagination approach is simple and stateless?
- Service A calls Service B, which is failing. Without protection, A keeps sending requests, cascading the failure. What pattern prevents this?