4 ms·
What user authentication does Stripe handle? As a user I've interacted with Stripe's services a lot, but I've never needed to authenticate myself to them.
by tremon 5y ago
What user authentication does Stripe handle? As a user I've interacted with Stripe's services a lot, but I've never needed to authenticate myself to them.
- pbreit 5y agohttps://stripe.com/docs/api/authentication https://stripe.com/docs/api/authentication Even pure server-to-server applications with "no user involved" are starting to use OAuth authentication which I don't quite understand. https://www.verygoodsecurity.com/docs/payment-optimization/authentication https://www.verygoodsecurity.com/docs/payment-optimization/a...
- DrBenCarson 5y agothe `client_credentials` grant is literally made for server-to-server applications
- pbreit 5y agoBut why bother with the extra call to request an access token? Makes everything harder for modest security gains.
- loginatnine 5y agoAccess tokens are short lived and can easily be revoked (when opaque). Sending your service credentials to every service is arguably less secure since they can have lesser security or log unwanted things.
- pbreit 5y agoRevocation is actually a major problem with JWTs.