Authentication Patterns

Common authentication patterns used across infrastructure APIs.

Methods Overview

Method Used By Header/Mechanism

Basic Auth

ISE (ERS, OpenAPI, MnT), WLC

Authorization: Basic base64(user:pass)

Bearer Token

pfSense, Keycloak, OpenAI

Authorization: Bearer {token}

API Key

Cloudflare, some SaaS

X-API-Key: {key} or query param

Session/Cookie

Synology DSM

_sid parameter after login

mTLS

ISE pxGrid, Vault (optional)

Client certificate

Vault Token

HashiCorp Vault

X-Vault-Token: {token}

Basic Auth

# Inline
curl -u "$USER:$PASS" https://api.example.com/

# Header (explicit)
curl -H "Authorization: Basic $(echo -n "$USER:$PASS" | base64)" https://api.example.com/

# ISE ERS example
curl -ks -u "$ISE_USER:$ISE_PASS" "https://$ISE_HOST:9060/ers/config/endpoint"

Bearer Token

# Direct
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/

# From login response
TOKEN=$(curl -s -X POST https://auth.example.com/token \
  -d "grant_type=client_credentials" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" | jq -r '.access_token')

curl -H "Authorization: Bearer $TOKEN" https://api.example.com/resource

Session-Based (Synology)

# Login and get session ID (Synology)
SID=$(curl -ks "https://$NAS:5001/webapi/auth.cgi?api=SYNO.API.Auth&version=3&method=login&account=$USER&passwd=$PASS&format=sid" | jq -r '.data.sid')

# Use session ID in subsequent requests
curl -ks "https://$NAS:5001/webapi/entry.cgi?api=SYNO.Core.System&version=1&method=info&_sid=$SID"

# Logout
curl -ks "https://$NAS:5001/webapi/auth.cgi?api=SYNO.API.Auth&version=1&method=logout&_sid=$SID"

Vault Token

# Login with AppRole
VAULT_TOKEN=$(curl -ks -X POST "$VAULT_ADDR/v1/auth/approle/login" \
  -d "{\"role_id\": \"$ROLE_ID\", \"secret_id\": \"$SECRET_ID\"}" | jq -r '.auth.client_token')

# Use token
curl -ks -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/kv/data/mypath"

# Or set env var
export VAULT_TOKEN
vault kv get kv/mypath

mTLS (Client Certificates)

# curl with client cert
curl -ks --cert client.pem --key client.key --cacert ca.pem \
  https://secure-api.example.com/

# ISE pxGrid example
curl -ks --cert pxgrid-client.pem --key pxgrid-client.key \
  "https://$ISE_HOST:8910/pxgrid/anc/getEndpointPolicies"

OAuth2 Flows

Client Credentials (Machine-to-Machine)

TOKEN=$(curl -s -X POST "https://auth.example.com/oauth/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" | jq -r '.access_token')

Password Grant (User Context)

TOKEN=$(curl -s -X POST "https://auth.example.com/oauth/token" \
  -d "grant_type=password" \
  -d "client_id=$CLIENT_ID" \
  -d "username=$USER" \
  -d "password=$PASS" | jq -r '.access_token')

Best Practices

  1. Never hardcode credentials - Use environment variables or secrets manager

  2. Use dsource - dsource d000 dev/network loads creds into env

  3. Token expiry - Check .expires_in and refresh before expiry

  4. Least privilege - Use role-specific accounts, not admin

  5. mTLS when available - Strongest auth, no shared secrets