Machine to machine REST authentication

Question

If you have multiple RESTful web services running on different subdomains (accounts.site.com, training.site.com, etc) what is a good authentication mechanism when one service needs to consume another?

Human authentication is easy because they supply their login credentials and get back a JSON Web Token which is then sent with every request to authenticate them.

A machine having a username and password just seems odd so I was wondering what are some proven ways of solving this problem?

Answer 1

It depends on... From the service perspective the other service is just a REST client, so let's stick with these terms.

• If you want access different user accounts with your REST client, then you must register your client by the service and you will get an API key. The user can give privileges to that API key, so you can do things in the name of the service users if they allow it.
• On the other hand if your client wants to access only its own account, then it is just a regular user of the service and it can have username and password just like the other users.