Authentication in Microservice Architectures

Authentication and authorization are related, but they answer different questions.

Authentication asks: who are you?

Authorization asks: what are you allowed to do?

Confusing the two creates systems where a valid user can perform actions they should not be able to perform.

Conceptual Flow

Client
-> API Gateway
-> Auth Service
-> JWT / access token
-> Backend Services

The auth service handles identity. Backend services still need to enforce permissions relevant to their domain.

Token Validation

JWT validation is not only decoding a token. Services need to validate signature, issuer, audience, expiration, and relevant claims.

Common claims include subject, issuer, audience, expiration, roles, and scopes. The exact claim model should match the organization’s security and domain model.

Do not trust identity sent directly by a client in a header unless the system has a trusted gateway boundary that strips and sets that header.

Centralized Authentication

Centralized authentication keeps login, identity lifecycle, token issuance, and credential handling in one place. This is often simpler and safer than every service implementing identity independently.

The trade-off is dependency. If the auth path is unhealthy, many services may be affected.

Distributed Authorization

Authorization often belongs partly inside each service. A billing service, education service, or account service may need domain-specific checks.

Gateway-level validation can reject obviously invalid requests, but service-level checks prevent over-trusting the edge.

JWT Risks

JWT is not automatically more secure than server-side sessions.

Risks include long expiry, leaked tokens, incorrect signature validation, missing audience validation, trusting client-provided identity, and embedding excessive information.

Short-lived access tokens, refresh strategies, key rotation, and careful claim design can reduce risk, but they add operational complexity.

Service-to-Service Authentication

Microservices also need to authenticate each other. Options include mTLS, signed service tokens, workload identity, or platform-specific identity mechanisms.

The right answer depends on infrastructure, threat model, and operational maturity.

Gateway vs Service Validation

Gateway validation reduces duplicated work and can centralize common checks. Service validation protects domain boundaries and reduces the blast radius of gateway mistakes.

Many production systems use both: the gateway validates coarse identity and services enforce domain-specific authorization.

Production Questions

• Who issues tokens?
• Which services validate tokens?
• What claims are required?
• How are keys rotated?
• How are leaked tokens revoked or expired?
• What is enforced at the gateway versus inside services?
• How is service-to-service trust established?

Security architecture should be explicit. “We use JWT” is not an answer by itself.