--- title: Authentication between microservices using Kubernetes... description: A hands-on walkthrough shows how to authenticate requests between two in-cluster Kubernetes services using Service Accounts and the TokenReview API. It deploys... canonical: https://daily.dev/posts/authentication-between-microservices-using-kubernetes-identities-esf6ksbwv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Authentication between microservices using Kubernetes identities | daily.dev og:description: A hands-on walkthrough shows how to authenticate requests between two in-cluster Kubernetes services using Service Accounts and the TokenReview API. It deploys... og:url: https://daily.dev/posts/authentication-between-microservices-using-kubernetes-identities-esf6ksbwv og:image: https://api.daily.dev/og/posts/Esf6ksBwv.png og:image:alt: Authentication between microservices using Kubernetes identities og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Authentication between microservices using Kubernetes identities **[LearnKube](https://daily.dev/sources/learnkube)** · 25 min read · 0 upvotes · 0 comments ## Summary A hands-on walkthrough shows how to authenticate requests between two in-cluster Kubernetes services using Service Accounts and the TokenReview API. It deploys an API and a data store service, demonstrates that direct unauthenticated requests fail, and explains how the data store validates tokens via Kubernetes RBAC and the system:auth-delegator ClusterRole. It then improves the setup with audience-bound projected Service Account tokens (via serviceAccountToken volume projection), which are time-limited and scoped to a specific audience, preventing token replay against unintended services. Ends by noting Linkerd, Istio, GKE, and AWS EKS use similar workload identity primitives. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I authenticate requests between two microservices running in the same Kubernetes cluster? Use Kubernetes Service Accounts combined with the TokenReview API: the calling service reads its mounted Service Account token and sends it in a header (such as X-Client-Id), and the receiving service validates that token against the Kubernetes API's TokenReview endpoint, checking both that it is authenticated and that the returned username matches an allowed identity, such as system:serviceaccount:api:api. _daily.dev surfaces practical Kubernetes security patterns for teams securing service-to-service traffic._ ### Why should I use audience-bound Service Account tokens instead of the default mounted token for service-to-service auth? The default automounted Service Account token is meant for calling the Kubernetes API and is not scoped to a specific destination service, so any service that can read it could replay it against the Kubernetes API within the token's validity. An audience-bound token created via serviceAccountToken volume projection restricts the token to a chosen audience (e.g. data-store), a path, and a lifetime as short as 600 seconds, so the receiving service can reject tokens not minted for it. _Developers hardening inter-service auth track token-scoping techniques like this on daily.dev._ ### What permission does a Kubernetes ClusterRole need to call the TokenReview API? A Service Account needs to be bound to the built-in system:auth-delegator ClusterRole via a ClusterRoleBinding, which grants create permissions on tokenreviews.authentication.k8s.io and subjectaccessreviews.authorization.k8s.io and nothing else - no access to Pods, Deployments, or Services. This lets a service validate incoming Service Account tokens without being granted any other cluster permissions. _Engineers scoping least-privilege RBAC bindings can find setups like this on daily.dev._ ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-ppeofcz2x) · Medium · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#golang](https://daily.dev/tags/golang), [#authentication](https://daily.dev/tags/authentication), [#microservices](https://daily.dev/tags/microservices) [View this post on daily.dev](https://daily.dev/posts/authentication-between-microservices-using-kubernetes-identities-esf6ksbwv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Authentication between microservices using Kubernetes identities","url":"https://daily.dev/posts/authentication-between-microservices-using-kubernetes-identities-esf6ksbwv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/authentication-between-microservices-using-kubernetes-identities-esf6ksbwv"},"datePublished":"2026-08-31T11:20:04.486Z","dateModified":"2026-08-31T11:20:49.747Z","description":"A hands-on walkthrough shows how to authenticate requests between two in-cluster Kubernetes services using Service Accounts and the TokenReview API. It deploys...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78472b83908f37690dc4383cb1c1ecf4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78472b83908f37690dc4383cb1c1ecf4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"LearnKube","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LearnKube","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/90786df1b5d44abb91a090a0b6c81517","url":"https://daily.dev/sources/learnkube"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/authentication-between-microservices-using-kubernetes-identities-esf6ksbwv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,golang,authentication,microservices","timeRequired":"PT25M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LearnKube","item":"https://daily.dev/sources/learnkube"},{"@type":"ListItem","position":3,"name":"Authentication between microservices using Kubernetes identities"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/authentication-between-microservices-using-kubernetes-identities-esf6ksbwv#faq","mainEntity":[{"@type":"Question","name":"How do I authenticate requests between two microservices running in the same Kubernetes cluster?","acceptedAnswer":{"@type":"Answer","text":"Use Kubernetes Service Accounts combined with the TokenReview API: the calling service reads its mounted Service Account token and sends it in a header (such as X-Client-Id), and the receiving service validates that token against the Kubernetes API's TokenReview endpoint, checking both that it is authenticated and that the returned username matches an allowed identity, such as system:serviceaccount:api:api. daily.dev surfaces practical Kubernetes security patterns for teams securing service-to-service traffic."}},{"@type":"Question","name":"Why should I use audience-bound Service Account tokens instead of the default mounted token for service-to-service auth?","acceptedAnswer":{"@type":"Answer","text":"The default automounted Service Account token is meant for calling the Kubernetes API and is not scoped to a specific destination service, so any service that can read it could replay it against the Kubernetes API within the token's validity. An audience-bound token created via serviceAccountToken volume projection restricts the token to a chosen audience (e.g. data-store), a path, and a lifetime as short as 600 seconds, so the receiving service can reject tokens not minted for it. Developers hardening inter-service auth track token-scoping techniques like this on daily.dev."}},{"@type":"Question","name":"What permission does a Kubernetes ClusterRole need to call the TokenReview API?","acceptedAnswer":{"@type":"Answer","text":"A Service Account needs to be bound to the built-in system:auth-delegator ClusterRole via a ClusterRoleBinding, which grants create permissions on tokenreviews.authentication.k8s.io and subjectaccessreviews.authorization.k8s.io and nothing else - no access to Pods, Deployments, or Services. This lets a service validate incoming Service Account tokens without being granted any other cluster permissions. Engineers scoping least-privilege RBAC bindings can find setups like this on daily.dev."}}]} ```