Authentication

Proving who a user or service is, with passwords, MFA, single sign-on or certificates. Centralise it in an identity provider rather than in each service.

Where it shows up in real systems

  • API gateway

    Centralises cross-cutting concerns so services stay simple. Validating JWTs locally costs almost nothing, while calling an auth service on every request adds latency and a dependency.

    In production: Amazon API Gateway, Kong, Apigee, Azure API Management, Tyk

  • Identity provider

    Handles passwords, MFA and social login, then issues short-lived tokens. Services that call it on every request inherit its latency and availability; validating signed JWTs locally avoids that dependency.

    In production: Auth0, Keycloak, Amazon Cognito, Microsoft Entra ID, Okta

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.

Open the learning path Open the sandbox