Forward Deployed Engineering Tutorial · Integration Engineering · Lesson 8 of 24
Customer APIs and Authentication
Connect to customer systems securely: API keys, OAuth 2.0 client credentials and authorization code flows, token refresh and secret storage.
Common ways customer systems authenticate you
| Method | How | Notes |
|---|---|---|
| API key | A static key in a header | Simple; rotate it and store it in a secret manager |
| OAuth 2.0 client credentials | Exchange a client ID and secret for a short-lived access token | Machine-to-machine integrations |
| OAuth 2.0 authorization code (+ PKCE) | A user grants your app access; you get access and refresh tokens | Acting on behalf of users (Google, Microsoft 365, Salesforce) |
| Mutual TLS | Client certificates | Banks, government |
| Signed requests | HMAC or cloud-native signatures (AWS SigV4) | Webhooks, cloud APIs |
Tokens expire
Access tokens typically last minutes to an hour. Cache the token, refresh it before it expires, and retry
once on 401 after refreshing.
class TokenClient:
"""Caches an OAuth access token and refreshes it shortly before it expires."""
def __init__(self, fetch_token, skew=60):
self.fetch_token, self.skew = fetch_token, skew
self.token, self.expires_at, self.fetches = None, 0, 0
def get(self, now):
if self.token is None or now >= self.expires_at - self.skew:
self.token, lifetime = self.fetch_token(now)
self.expires_at = now + lifetime
self.fetches += 1
return self.token
def fake_token_endpoint(now): # POST /oauth/token grant_type=client_credentials
return f"tok-{now}", 3600
client = TokenClient(fake_token_endpoint)
for t in [0, 600, 3000, 3539, 3541, 7000]:
print(f"t={t:5}s use {client.get(t)}")
print("token requests:", client.fetches)
Output
t= 0s use tok-0 t= 600s use tok-0 t= 3000s use tok-0 t= 3539s use tok-0 t= 3541s use tok-3541 t= 7000s use tok-3541 token requests: 2
Rules
- Ask for the least privilege (scopes) the integration needs, and document why.
- Keep customer credentials in a secret manager, per customer, never in code or tickets.
- Prefer customer-managed credentials they can revoke, and agree a rotation process.
Test yourself
Which OAuth flow fits a nightly server-to-server sync with no user involved?
Client credentialsAuthorization code with PKCEImplicit flowPassword grant
Show answer
Answer: Client credentials
No user is present, so the service authenticates as itself.