API Key vs JWT vs OAuth 2.0

Different problems. Different tools. Use the right one for the job.

📌Overview

Authentication mechanisms differ based on the context and use case. This guide compares API Key, JWT, and OAuth 2.0, explaining when to use each, real-world examples, and their applications in AI engineering.

📌API Key

📌Description

Application → Application (No user context).
Used for direct communication between applications or services.

📌Use When

One application or service needs to call another application or service.

📌Real Examples

OpenAI API Key
Anthropic API Key
Stripe Secret Key
Weather API
Internal microservices

📌AI Engineer Examples

LLM API calls (OpenAI, Anthropic, etc.).
Agent → Tool / MCP server communication.
Backend services calling third-party APIs.
Scheduled jobs / cron tasks.

📌JWT

📌Description

User → Application (User is authenticated).
Used for identifying and authorizing logged-in users.

📌Use When

A user is logged in, and your application needs to identify and authorize that user.

📌Real Examples

ChatGPT logged-in session.
Claude / CoWork workspace.
HackProduct dashboard.
Mobile / web app sessions.
Internal admin portals.

📌AI Engineer Examples

AI SaaS dashboards (per-user access).
Multi-user workspaces (CoWork, team features).
Role & permission-based access (admin, editor, etc.).
Mobile apps.

📌OAuth 2.0

📌Description

User → Third-Party (Delegated access).
Used for granting permission to access another service on behalf of the user.

📌Use When

Your application needs permission to access another service on behalf of the user.

📌Real Examples

Sign in with Google / GitHub.
Connect Slack workspace.
Connect Gmail / Drive.
Connect Calendar.
Enterprise SSO.

📌AI Engineer Examples

ChatGPT connecting Google Drive.
Claude connecting Slack.
AI agent reading user's Gmail.
Access user's Calendar.
Company SSO (Okta, Auth0, etc.).

📌How ChatGPT Uses All Three

1. User logs in (to ChatGPT)
↷
Uses OAuth 2.0 ChatGPT uses OAuth to let you sign in with Google, Microsoft, Apple, or GitHub. 2. ChatGPT creates your session
↷
Uses JWT After login, ChatGPT issues a JWT session token to identify you in every request. 3. ChatGPT calls OpenAI services (and more)
↷
Uses API Key ChatGPT's backend uses API Keys to call OpenAI APIs or other third-party services

📌Real-Time Story: 🌟 A Day in the Life of Authentication

Imagine Sarah, a software engineer, logging into her favorite productivity app, TaskFlow.

OAuth 2.0: Sarah uses her Google account to sign in. TaskFlow delegates authentication to Google, ensuring Sarah’s credentials are secure without storing them directly.
JWT: Once logged in, TaskFlow generates a JWT token for Sarah’s session. This token allows TaskFlow to identify her and grant access to her personalized dashboard.
API Key: Sarah uses a feature that integrates with OpenAI’s API to summarize her tasks. TaskFlow uses its API Key to securely communicate with OpenAI’s servers and fetch the results.

By combining these three mechanisms, TaskFlow ensures seamless, secure, and efficient authentication and authorization for Sarah’s experience.