Agent WranglersAPI security Required
Authenticate with tokens in headers
Authenticate API calls with short-lived tokens in the Authorization header, issued through OAuth 2 for anything acting for a user.
How to do it
Follow the OAuth security best practice in RFC 9700. Use the authorization code flow with PKCE for apps, and client credentials for servers. Publish protected resource metadata as RFC 9728 describes. Check every token as in token checks.
How to check
A call without a token gets 401 with a WWW-Authenticate header. An expired token gets 401 too.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/token-auth.