Authentification d'API : les bases en 2026

# Pattern correct
@app.get("/api/orders/{order_id}")
def get_order(
    order_id: int,
    current_user: User = Depends(authenticate),  # AUTHN : qui es-tu ?
):
    order = db.query(Order).filter(Order.id == order_id).first()
    if not order:
        raise HTTPException(404)
    
    # AUTHZ : as-tu le droit sur cet objet précis ?
    if order.owner_id != current_user.id and "admin" not in current_user.roles:
        raise HTTPException(403)
    
    return order

# Header standard (recommandé)
GET /api/v1/products HTTP/1.1
Host: api.example.test
X-API-Key: sk_live_4eC39HqLyjWDarjtT1zdp7dc
 
# Alternative : query parameter (déconseillé : apparaît dans logs URL)
GET /api/v1/products?api_key=sk_live_4eC39HqLyjWDarjtT1zdp7dc HTTP/1.1

from fastapi import FastAPI, Header, HTTPException
import hashlib
import secrets
 
app = FastAPI()
 
# API keys stockées hashées en base (jamais en clair)
API_KEYS_DB = {
    "sha256_hash_de_la_cle_1": {"client_id": "partner_a", "rate_limit": 1000},
    "sha256_hash_de_la_cle_2": {"client_id": "partner_b", "rate_limit": 100},
}
 
def verify_api_key(x_api_key: str = Header(...)):
    if not x_api_key:
        raise HTTPException(401, "Missing API key")
    
    key_hash = hashlib.sha256(x_api_key.encode()).hexdigest()
    if key_hash not in API_KEYS_DB:
        raise HTTPException(401, "Invalid API key")
    
    return API_KEYS_DB[key_hash]
 
@app.get("/api/v1/products")
def list_products(client = Depends(verify_api_key)):
    return {"client_id": client["client_id"], "products": [...]}

GET /api/v1/products HTTP/1.1
Host: api.example.test
Authorization: Basic dXNlcjpwYXNzd29yZA==

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleS0yMDI2In0
.
eyJzdWIiOiJ1c2VyXzEyMyIsImVtYWlsIjoidXNlckBleGFtcGxlLnRlc3QiLCJyb2xlcyI6WyJ1c2VyIl0sImlhdCI6MTcxNDExODQwMCwiZXhwIjoxNzE0MTIyMDAwLCJpc3MiOiJodHRwczovL2lkcC5leGFtcGxlLnRlc3QiLCJhdWQiOiJhcGkuZXhhbXBsZS50ZXN0In0
.
RS256_signature_base64url

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "key-2026"
}

{
  "sub": "user_123",
  "email": "user@example.test",
  "roles": ["user"],
  "iat": 1714118400,
  "exp": 1714122000,
  "iss": "https://idp.example.test",
  "aud": "api.example.test"
}

import jwt
from jwt import PyJWKClient
 
# Récupération des clés publiques via JWKS endpoint (RFC 7517)
jwks_client = PyJWKClient("https://idp.example.test/.well-known/jwks.json")
 
def verify_jwt(token: str) -> dict:
    try:
        # Récupère la clé publique correspondant au kid du header
        signing_key = jwks_client.get_signing_key_from_jwt(token)
        
        # Décode et valide
        payload = jwt.decode(
            token,
            signing_key.key,
            algorithms=["RS256"],  # CRUCIAL : whitelist explicite
            issuer="https://idp.example.test",
            audience="api.example.test",
            options={
                "verify_signature": True,
                "verify_exp": True,
                "verify_iat": True,
                "verify_iss": True,
                "verify_aud": True,
                "require": ["exp", "iat", "iss", "aud", "sub"],
            }
        )
        return payload
    except jwt.ExpiredSignatureError:
        raise HTTPException(401, "Token expired")
    except jwt.InvalidTokenError as e:
        raise HTTPException(401, f"Invalid token: {e}")

┌────────────┐                                ┌────────┐                    ┌──────┐
│ User Agent │                                │  IdP   │                    │ App  │
│ (Browser)  │                                │ (Auth0,│                    │ API  │
└────────────┘                                │ Okta,  │                    └──────┘
                                              │ Keycloak)
                                              └────────┘
       │   1. Click login app                      │                          │
       ├──────────────────────────────────────────────────────────────────────►
       │                                            │                          │
       │   2. Redirect to IdP authorize endpoint   │                          │
       │   (avec code_challenge PKCE)              │                          │
       ◄──────────────────────────────────────────────────────────────────────┤
       │                                            │                          │
       │   3. User authentifie + consent            │                          │
       ├───────────────────────────────────────────►│                          │
       │                                            │                          │
       │   4. Redirect avec authorization code      │                          │
       ◄───────────────────────────────────────────┤                          │
       │                                            │                          │
       │   5. Exchange code for tokens              │                          │
       │   (avec code_verifier PKCE)                │                          │
       ├──────────────────────────────────────────────────────────────────────►
       │                                            │                          │
       │   6. Access token + Refresh token + ID    │                          │
       │   token (OIDC)                             │                          │
       ◄──────────────────────────────────────────────────────────────────────┤
       │                                            │                          │
       │   7. API call with Bearer access token    │                          │
       ├──────────────────────────────────────────────────────────────────────►
       │                                            │                          │
       │   8. Validate JWT, return data             │                          │
       ◄──────────────────────────────────────────────────────────────────────┤

curl -X POST https://idp.example.test/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=service-a" \
  -d "client_secret=<secret>" \
  -d "scope=read:orders write:orders"

server {
    listen 443 ssl http2;
    server_name api.example.test;
    
    # Certificat serveur classique
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    
    # Configuration mTLS : exiger client cert
    ssl_client_certificate /etc/nginx/ssl/ca.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;
    
    # Reverse proxy vers backend
    location / {
        proxy_pass http://backend:8080;
        # Transmettre les infos du cert client au backend
        proxy_set_header X-Client-Cert-DN $ssl_client_s_dn;
        proxy_set_header X-Client-Cert-Verify $ssl_client_verify;
        proxy_set_header X-Client-Cert-Fingerprint $ssl_client_fingerprint;
    }
}

import hmac
import hashlib
import time
import json
 
WEBHOOK_SECRET = "whsec_4eC39HqLyjWDarjtT1zdp7dc"
 
def send_webhook(url: str, event: dict):
    payload = json.dumps(event)
    timestamp = int(time.time())
    
    # Signature : HMAC-SHA256 de "timestamp.payload"
    signed_payload = f"{timestamp}.{payload}"
    signature = hmac.new(
        WEBHOOK_SECRET.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    headers = {
        "Content-Type": "application/json",
        "X-Signature-Timestamp": str(timestamp),
        "X-Signature": f"sha256={signature}",
    }
    
    requests.post(url, data=payload, headers=headers)

def verify_webhook(request, secret: str, max_age: int = 300):
    timestamp = request.headers.get("X-Signature-Timestamp")
    signature_header = request.headers.get("X-Signature")
    
    if not timestamp or not signature_header:
        raise HTTPException(401, "Missing signature headers")
    
    # Anti-replay : refuser les anciens timestamps (> 5 min)
    if abs(time.time() - int(timestamp)) > max_age:
        raise HTTPException(401, "Timestamp too old")
    
    # Reconstruction signature attendue
    payload = request.body.decode()
    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    # Comparaison constant-time pour éviter timing attacks
    received_signature = signature_header.replace("sha256=", "")
    if not hmac.compare_digest(expected_signature, received_signature):
        raise HTTPException(401, "Invalid signature")
    
    return json.loads(payload)

// Renewal automatique en TS
async function callApi(url: string) {
  let accessToken = getStoredAccessToken();
  
  let response = await fetch(url, {
    headers: { Authorization: `Bearer ${accessToken}` }
  });
  
  if (response.status === 401) {
    // Tentative de renewal
    accessToken = await refreshAccessToken();
    storeAccessToken(accessToken);
    
    // Retry
    response = await fetch(url, {
      headers: { Authorization: `Bearer ${accessToken}` }
    });
  }
  
  return response;
}
 
async function refreshAccessToken(): Promise<string> {
  const refreshToken = getStoredRefreshToken();
  const response = await fetch("/api/auth/refresh", {
    method: "POST",
    body: JSON.stringify({ refreshToken }),
  });
  const data = await response.json();
  return data.accessToken;
}

# API valide chaque token via call à l'IdP au lieu de validation locale JWT
def verify_token_via_introspection(token: str):
    response = requests.post(
        "https://idp.example.test/oauth2/introspect",
        data={"token": token},
        auth=(API_CLIENT_ID, API_CLIENT_SECRET),
    )
    introspection = response.json()
    if not introspection.get("active"):
        raise HTTPException(401, "Token revoked or invalid")
    return introspection

{
  "sub": "user_123",
  "scope": "read:orders write:orders read:profile",
  "iat": 1714118400,
  "exp": 1714122000
}

def require_scope(*required_scopes):
    def decorator(func):
        @wraps(func)
        async def wrapper(*args, **kwargs):
            token = extract_token()
            payload = verify_jwt(token)
            granted_scopes = set(payload.get("scope", "").split())
            
            for scope in required_scopes:
                if scope not in granted_scopes:
                    raise HTTPException(403, f"Missing scope: {scope}")
            
            return await func(*args, **kwargs)
        return wrapper
    return decorator
 
@app.delete("/api/orders/{order_id}")
@require_scope("write:orders")
async def cancel_order(order_id: int):
    pass

# Istio : enforce mTLS strict sur tout le namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

Client → API Gateway → Backend Service
 
API Gateway :
1. Valide JWT (signature, expiration, audience)
2. Extrait user_id depuis sub claim
3. Transmet vers backend :
   - X-User-ID: user_123
   - X-User-Roles: user,manager
   - X-User-Email: user@example.test