API Gateways, API Keys, and mTLS for Service-to-Service Auth

As systems grow into many services calling one another, a new question arises: how does one service prove its identity to another, and where are cross-cutting controls enforced? This lesson covers three answers that work together: the API gateway as a central control point, API keys for identifying client applications, and mutual TLS for strong, cryptographic service-to-service authentication.

Analogy🏏Cricket

🍳 Think of it like cooking: A recipe can look flawless on paper, but a head chef only truly judges the dish by tasting the finished plate, because heat, timing, and the actual oven reveal problems the written method never shows. Just as tasting the cooked result catches what reading the recipe cannot, DAST probes the running application and catches the misconfigurations and runtime behaviour that reading the source cannot. This reveals DAST's stance: it judges the dish as it is actually served, not the recipe as it was merely written.

The distinction that matters most is between identifying a caller and authenticating them. An API key names which application is calling but is only a shared secret that can leak. Mutual TLS, by contrast, cryptographically proves each side's identity using certificates. Choosing the right mechanism for the trust level required, and centralising enforcement at a gateway, is the core of securing service architectures.

Analogy🏏Cricket

💰 Think of it like finance: A real audit that actually attempts a sample transaction proves beyond doubt whether a control can be bypassed, with little room for a false alarm, but it can only test the accounts and processes the auditors actually reach. Just as a hands-on audit yields high-confidence, low-false-positive results yet is bounded by what it examines, DAST yields high-confidence findings about real exploitability yet is bounded by the surface it can reach. This reveals its trade-off: what it confirms is solid, but it only confirms what it manages to touch.