deangrant OAuth 2.0 and API Keys
Use this skill when choosing credential models for humans and machines.
1. Selection
| Model | Use |
|---|---|
| API keys | Simple service access; header-only (never query); rotate |
| Client credentials | M2M confidential clients |
| Auth code + PKCE | User-delegated apps (public/native) |
| Refresh tokens | Long sessions with short-lived access tokens |
Scopes = least privilege. Audit client scope usage.
2. Quick checklist
- Keys in headers only; stored hashed server-side when possible.
- Right OAuth flow for client type.
- Short-lived access tokens; scoped.
- Rotation without downtime.
See reference.md and examples.md.