Security scheme

As explained in Secure APIs

A security scheme is an OpenAPI configuration object that describes how an API request is authenticated and authorized, including credential type, placement, and scopes.

A security scheme is an OpenAPI configuration object that documents how an API authenticates and authorizes requests, including token type, placement, authorization details, and access scopes. section 8.1

Apply a security scheme deliberately:

• Decide which operations require authentication and whether user groups, such as drivers and passengers, need different access. section 8.1
• Define schemes under components.securitySchemes, then apply them globally or override them for individual operations. section 8.1
• For JWTs, validate signatures, claims, and permitted algorithms on every request; middleware is the recommended location. section 8.7

JWT bearer scheme

An OpenAPI 3.1.1 specification can define a JWT bearer scheme with type http, scheme Bearer, and bearerFormat JWT. A global security requirement can protect the API, while an operation such as /hello can set security: [] to remain public. section 8.1

Figure 8.1 We define the security schemes that protect our API in the specification’s components section under securitySchemes, and we apply them globally to the API under the specification’s security field or per operation using the operation’s security field.

Shows how security schemes are defined in components.securitySchemes and applied globally or per operation. section 8.1

How Secure APIs covers it

How deep it goes

Explains scheme fields and application scope, then connects JWT schemes to validation without detailing every authentication flow.

Examples

Uses a JWT bearer definition and a globally protected API with a public operation override.

What it assumes

Assumes decisions about protected operations and user access, while introducing their OpenAPI representation.

What you can do after

Configure OpenAPI security schemes globally or per operation and recognize essential JWT validation checks.

How it connects

Connects OpenAPI security schemes with JWT, OIDC, access tokens, scopes, and role-based access control.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eAn OpenAPI security scheme is a declaration describing the authentication or authorization mechanism an HTTP API uses to protect operations.
• 

  liveBookmanning.com
  The Design of Web APIs, Second EditionA security scheme is an API security mechanism definition that specifies how a consumer authenticates or authorizes access.

Compare how 3 books explain security scheme →

Related concepts

• OpenAPI specificationused by · The OpenAPI Specification is a standard, machine-readable format for describing HTTP APIs, including their operations, inputs, outputs, data structures, and security requirements.
• AddSecurityDefinitionimplemented by · AddSecurityDefinition is a Swashbuckle configuration method that registers a security scheme in an OpenAPI document.
• breaking changeproduces · A breaking change is a modification to an interface, behavior, format, configuration, or contract that can prevent existing consumers from working correctly without changes.
• scopehas part · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.