API Authentication Patterns — Keys, Tokens, and Machine-to-Machine Auth

Not every API consumer is a human clicking buttons in a browser. Your API is also called by backend services, cron jobs, third-party integrations, CI/CD pipelines, mobile apps, and other APIs. Each has different security requirements, different trust levels, and different authentication patterns.

When your AI agent generates API routes, it typically handles user authentication well — checking JWTs, validating sessions. But what about the webhook from Stripe? The cron job that syncs data every hour? The partner integration that calls your API from their server? These need authentication too, and "just use a JWT" isn't always the right answer.

The Three Main Patterns

API authentication falls into three broad categories:

API Keys — Simple, long-lived secrets. The caller includes