How do you handle authentication and authorization across microservices?
Learn how to handle authentication and authorization across microservices using API gateways, JWTs, identity providers, RBAC, and mutual TLS.
Expected Interview Answer
You centralize authentication at the edge (an API gateway or dedicated identity provider) which verifies credentials once and issues a signed token, then each microservice independently validates that token and enforces its own authorization rules — so identity is established centrally but access decisions stay local.
A typical pattern uses an identity provider (Keycloak, Auth0, Cognito) that authenticates the user and returns a JWT or reference token. The API gateway validates the token on the way in and forwards the request with the verified identity and claims to downstream services. Each service then performs authorization — checking scopes, roles, or policies (often via RBAC or a policy engine like OPA) to decide what the caller may do. Service-to-service calls are secured separately, commonly with mutual TLS or the OAuth2 client-credentials flow, so internal traffic is trusted and encrypted.
- Single sign-on: users authenticate once at the edge
- Stateless verification with signed tokens scales horizontally
- Each service enforces fine-grained, local authorization
- Consistent identity via a central identity provider
- Service-to-service trust via mTLS or client-credentials
AI Mentor Explanation
Authentication is the gate steward who checks your match ticket once as you enter the stadium and gives you a stamped wristband. Authorization is each area steward glancing at that wristband to decide whether you may enter the members' pavilion, the dressing room, or just the general stands. The gate verifies who you are once; every inner door independently checks what your band allows.
Step-by-Step Explanation
Step 1
Authenticate at the edge
An identity provider (Keycloak, Auth0, Cognito) verifies credentials and issues a signed token (JWT).
Step 2
Validate at the gateway
The API gateway checks the token's signature and expiry, rejecting invalid requests before they reach services.
Step 3
Propagate identity
The gateway forwards the verified identity and claims (user, roles, scopes) to downstream services.
Step 4
Authorize locally
Each service enforces RBAC/ABAC rules — often via a policy engine like OPA — to decide what the caller may do.
Step 5
Secure service-to-service
Internal calls use mutual TLS or the OAuth2 client-credentials flow so services trust each other.
What Interviewer Expects
- Clear separation of authentication (who you are) from authorization (what you can do)
- Centralized identity provider issuing signed tokens
- API gateway validating tokens at the edge
- Each service enforcing its own fine-grained authorization
- Service-to-service security via mTLS or client-credentials
Common Mistakes
- Confusing authentication with authorization
- Trusting downstream traffic without verifying tokens per service
- Storing session state per service instead of using stateless tokens
- Ignoring service-to-service authentication entirely
- Putting all authorization logic only at the gateway, leaving services open
Best Answer (HR Friendly)
“You check who a user is once at the front door using a central login system that hands out a secure token. After that, each service reads the token to decide what that user is allowed to do, and services also prove their identity to each other so internal traffic stays trusted.”
Code Example
import jwt from 'jsonwebtoken'
function authorize(requiredRole) {
return (req, res, next) => {
const token = req.headers.authorization?.split(' ')[1]
if (!token) return res.status(401).json({ error: 'No token' })
try {
const claims = jwt.verify(token, process.env.JWT_PUBLIC_KEY, {
algorithms: ['RS256'],
})
if (!claims.roles?.includes(requiredRole)) {
return res.status(403).json({ error: 'Forbidden' })
}
req.user = claims
next()
} catch (err) {
return res.status(401).json({ error: 'Invalid token' })
}
}
}
app.get('/orders', authorize('order:read'), getOrders)Follow-up Questions
- What is the difference between OAuth2 and OpenID Connect?
- How do you revoke a stateless JWT before it expires?
- What is mutual TLS and when do you use it between services?
- How does an API gateway differ from a service mesh for auth?
- What is the difference between RBAC and ABAC?
MCQ Practice
1. Which statement best separates authentication from authorization?
Authentication establishes who the caller is; authorization determines what that verified caller is allowed to do.
2. How are service-to-service calls typically secured in microservices?
Internal traffic is commonly secured with mutual TLS or the OAuth2 client-credentials flow so services can trust each other.
3. Why prefer stateless signed tokens over server-side sessions in microservices?
Signed tokens can be validated independently by each service, avoiding a central session store and scaling horizontally.
Flash Cards
Authentication — Verifying who the caller is, usually once at the edge via an identity provider.
Authorization — Deciding what the verified caller may do, enforced by each service.
API gateway role — Validates tokens at the edge and forwards verified identity downstream.
Service-to-service auth — Secured with mutual TLS or the OAuth2 client-credentials flow.
Continue Learning
Related Interview Questions
What is the difference between JWT and opaque tokens in a microservices context?
medium
How do you establish workload identity with mutual TLS, and what breaks when certificates rotate?
hard
How does Spring Security handle authentication and authorization?
medium
What is an API gateway and what role does it play in microservices?
medium