Benefits of client credentials versus API keys

Use a workload identity for non-human interaction tasks. In a workload identity scenario, you consume the Spark APIs using either OAuth 2.0 Client Credentials or API keys.

• API key: A type of secret shared between a provider and consumer, used through a secure and predefined mechanism for authentication or access.

• Client credentials: A method of authentication where a system uses a client ID and secret to authenticate itself directly to an identity provider, typically for server-to-server communication.

Feature	Client credentials	API keys
Purpose	Secure, OAuth 2.0-based client authentication.	Simplistic access to APIs, often without user context.
Security	More secure with tokens and client secret authentication.	Less secure; easily exposed if not handled carefully.
Ease of use	Requires OAuth 2.0 flow and token exchange.	Simple to implement; just include a key in API requests.
Scope	Full access to the same features accessible to a user.	Functionality is limited based upon Permissions - Features permissions.
Granularity	Fine-grained control over scopes and permissions.	Limited scope and permissions control.
Expiration	Access tokens have short lifetimes, improving security.	Typically static; does not expire by default.
Use cases	High-security applications, server-to-server interactions.	Quick integrations, server-to-server, low-security apps.
Traceability	Easy to trace and audit based on token issuance.	Difficult to track usage to specific clients.
Standards compliance	Follows OAuth 2.0 standards.	Not standardized; varies by implementation.

When to use OAuth 2.0 client credentials or API keys

Use Client credentials grant (OAuth 2.0):

• Your organization requires OAuth 2.0 compliance.

• You need to consume Spark System APIs that do not support API keys.

• You require access that is fully auditable, revocable, and supports fine-grained scopes.

• You want to integrate with zero trust principles, including strong authentication and access controls.

• Example: You have a Python script that runs every 12 h. Acquire an access token via the OAuth 2.0 client credentials grant. It uses the token to access your Spark tenant and generates a report on the tenant service consumption.

Use Authorization - API keys:

• You need to integrate with your Spark service.

• Example: You created a Spark rating service to generate quotes based on input parameters. The service is published through an API management solution, which provides a URL for anonymous users. The API management software can securely forward requests to the rater service with an included API key for authorization.