Service-to-Service Authentication

It can be tempting to trust a service call simply because it comes from inside the network. Suppose the bookstore's checkout and inventory services run on a private network, and inventory accepts any request that reaches its reservation endpoint. A compromised reporting job could then reserve stock too, even though reporting has no reason to perform that operation.

Service-to-service authentication establishes which software identity made a call. The receiver can then apply permissions appropriate to that service.

This chapter explains service identities, client credentials, mutual TLS, automated credential issuance, and the trust boundaries that proxies and downstream calls introduce.

The examples use fictional bookstore services communicating over HTTPS. Checkout may create inventory reservations, while reporting may only read availability. The HTTP walkthrough uses OAuth client credentials with bearer access tokens. This chapter discusses certificate-based approaches as alternatives or additional controls; the walkthrough does not use them.