Security

Who may call your API, and what they may do.

• Authentication - logins (password, OAuth2/Okta, federated), tokens, and authenticating requests
• Access Control - role-based and fine-grained permissions
• API keys and CORS - service-to-service calls and browser apps on other origins