Token Based Authentication

A trusted 3rd party issues tokens

Tokens are used to authenticate the caller

Can expire

Can have an audience

The API trusts the issuer of the token

Can convey both user and machine identity