Zero Trust architecture assumes no implicit trust—every request, regardless of origin, must be verified. For APIs, this means moving beyond shared API keys to multi-layer verification strategies that authenticate every request in context.
Core Principles
Verify explicitly: Authenticate and authorize every request, not just the first one in a session. Least privilege: Grant minimum permissions for minimum duration. Issue tokens scoped to exactly one operation. Assume breach: Design your system assuming an attacker already has access to some part of it. Compartmentalize so that a breach in one service does not compromise others.
mTLS for Service-to-Service Communication
Mutual TLS ensures both the client and server present valid certificates. This prevents unauthorized services from connecting, even within the same private network. Certificate rotation should be automated—manual certificate management is the most common source of mTLS failures in production.
Short-Lived Tokens
Issue tokens with TTL measured in minutes, not hours or days. A token that lives for 15 minutes limits the damage window if leaked. Rotate signing keys frequently and support key rotation without downtime by maintaining a overlap window where both old and new keys are accepted.
Continuous Verification
Do not check authorization only at the API gateway. Re-verify on sensitive operations within the application. If a user's IP address changes mid-session, flag it for review. If a token is revoked, the next request should fail immediately, not when the cached session expires.
Audit Logging
Log every authentication decision: who authenticated, what resource they accessed, when, and whether access was allowed or denied. Store logs immutably in object storage with write-once policies. Immutable logs satisfy compliance requirements and provide forensic evidence in the event of a breach.
Practical Implementation
Use Cloudflare Access or similar for external API gateways. Implement OAuth 2.0 with short-expiry JWTs. Add request signing for critical write operations using HMAC or asymmetric signatures. Rate-limit by identity, not just IP address—an attacker rotating through IPs should still hit your rate limit.
