API authentication (API key, OAuth 2.0, PAT)
API authentication is how an API verifies the identity of a caller before serving a request. The common schemes are API keys (a static secret sent in a header), OAuth 2.0 (delegated access through short-lived tokens issued via defined grant flows), and personal access tokens (user-generated, account-scoped secrets). The scheme determines how a client obtains, presents, refreshes, and scopes its credentials.
An agent must learn the entire credential lifecycle from documentation: where a credential is created, which header or parameter carries it, what scopes exist, when tokens expire, and how refresh works. Every one of these is a fact the agent cannot discover by probing — a missing detail becomes a failed integration at the first authenticated call.
The schemes differ sharply in agent-friendliness. API keys and personal access tokens suit unattended automation because a human can provision them once and the agent uses them indefinitely. OAuth 2.0 flows built around browser redirects and user consent assume a human present at integration time; docs that clearly mark a machine-to-machine path — client credentials grant, or a PAT alternative — spare agents from flows they cannot complete alone.
Authentication docs are also where security guidance belongs: how to store secrets, what a leaked key can do, and how rotation works. Coding agents scaffold what the examples show, so examples that handle credentials properly propagate that hygiene into generated integrations.
What does an AI agent make of your API?
Find out in about a minute — no signup.
Discry your API — free