API Security and Authentication Questions

Design and operational practices for securing application programming interfaces and the authentication and authorization patterns that protect them. Topics include the difference between authentication and authorization, token based authentication using JSON Web Token, OAuth two flows and appropriate use cases, token expiration and revocation patterns, refresh token strategies, scopes and claims, authorization models such as role based access control and attribute based access control, service to service authentication, mutual transport layer security, API gateway patterns, rate limiting and throttling, input validation and injection protection, request signing and replay protection, secure error handling and telemetry, and key and secret rotation strategies. Questions assess both defensive design choices and practical operational controls for running secure APIs at scale.