securityschemes

Security schemes are formal mechanisms used to control access to systems, resources, and data. They describe how a client proves its identity and how the system enforces authorization for a given operation. In software and network design, security schemes may operate at the transport or application layer and can be defined within specifications such as OpenAPI for describing API protections or implemented directly by servers and identity providers.

Common types include authentication methods such as HTTP Basic authentication, bearer tokens (often OAuth 2.0 access tokens), API keys, and mutual TLS (mTLS). Some systems also use certificates, SAML-based single sign-on, or JSON Web Tokens (JWTs) carrying claims used for authorization. Each scheme has tradeoffs in usability, scalability, and risk. Basic and API key schemes are simple but can be vulnerable if credentials are exposed; OAuth 2.0 and OpenID Connect provide token-based flows with scopes and consent. Mutual TLS delivers strong machine authentication but requires certificate management.

Implementation considerations include using transport-layer security with TLS, protecting secrets in transit and at rest, employing short-lived tokens and proper revocation/rotation, and applying least-privilege access. It is also important to audit access events and separate identity verification from resource authorization where possible.

In API design, security schemes describe how clients authenticate and what credentials are required, enabling consistent enforcement of access control. They are often combined with scope-based access control and claim rules to support fine-grained permissions.