--- title: Your API Can Be Authenticated and Still Be Insecure description: A discussion post argues that authentication alone is insufficient for API security, since a valid JWT confirms identity but not permissions. It raises... canonical: https://daily.dev/posts/your-api-can-be-authenticated-and-still-be-insecure-4ikr7misu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your API Can Be Authenticated and Still Be Insecure | daily.dev og:description: A discussion post argues that authentication alone is insufficient for API security, since a valid JWT confirms identity but not permissions. It raises... og:url: https://daily.dev/posts/your-api-can-be-authenticated-and-still-be-insecure-4ikr7misu og:image: https://api.daily.dev/og/posts/4iKR7MIsU.png og:image:alt: Your API Can Be Authenticated and Still Be Insecure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your API Can Be Authenticated and Still Be Insecure **[DevOps & Platform Engineering Hub](https://daily.dev/sources/sanjay)** · [@divyansh30](https://daily.dev/divyansh30) · 1 min read · 1 upvotes · 0 comments ## Summary A discussion post argues that authentication alone is insufficient for API security, since a valid JWT confirms identity but not permissions. It raises questions for DevOps and platform teams about where to enforce role-based access control (application vs API gateway), how granular permissions should be, and links to an external example implementing RBAC with FastAPI and Keycloak covering JWT validation and permission checks. ## Content Getting authentication working is usually the easy part. The harder question is what an authenticated user is actually allowed to do. A valid JWT only tells you who the user is. It doesn't tell you what they're allowed to do. That's where roles, permissions, and authorization checks become important. I'm curious how other DevOps and platform teams handle this: - Do you manage API roles centrally? - Where do you enforce permissions: in the application, API gateway, or both? - How granular do your permissions get? - Have you ever found an authorization issue after authentication was already working? I came across a practical example using **FastAPI and Keycloak** that looks at JWT validation, role-based access, permissions, and API authorization. [https://www.kubeblogs.com/fastapi-rbac-keycloak/](https://www.kubeblogs.com/fastapi-rbac-keycloak/) How are you handling authentication and authorization across your services? #DevOps #PlatformEngineering #APISecurity #Keycloak #FastAPI #DevSecOps ## Similar posts on daily.dev - [API Authentication & Authorization: An Engineering Deep Dive into Mechanisms, Trade-offs, and Failure Modes](https://daily.dev/posts/api-authentication-authorization-an-engineering-deep-dive-into-mechanisms-trade-offs-and-failur-tn7ivgfru) · freeCodeCamp · 4 upvotes · 0 comments - [JWT Authentication Without the Confusion](https://daily.dev/posts/jwt-authentication-without-the-confusion-tvh5u1id9) · Medium · 1 upvotes · 0 comments - [API Authentication Methods Explained: API Keys, OAuth, JWT & HMAC Compared](https://daily.dev/posts/api-authentication-methods-explained-api-keys-oauth-jwt-hmac-compared-b3g34ltcj) · Security Boulevard · 1 upvotes · 0 comments - [How to Secure APIs with OAuth 2.1 and OpenID Connect](https://daily.dev/posts/how-to-secure-apis-with-oauth-2-1-and-openid-connect-rf7g6orkv) · C\# Corner · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#infrastructure](https://daily.dev/tags/infrastructure), [#authorization](https://daily.dev/tags/authorization), [#jwt](https://daily.dev/tags/jwt), [#fastapi](https://daily.dev/tags/fastapi) [View this post on daily.dev](https://daily.dev/posts/your-api-can-be-authenticated-and-still-be-insecure-4ikr7misu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/your-api-can-be-authenticated-and-still-be-insecure-4ikr7misu","headline":"Your API Can Be Authenticated and Still Be Insecure","text":"A discussion post argues that authentication alone is insufficient for API security, since a valid JWT confirms identity but not permissions. It raises questions for DevOps and platform teams about where to enforce role-based access control (application vs API gateway), how granular permissions should be, and links to an external example implementing RBAC with FastAPI and Keycloak covering JWT validation and permission checks.","url":"https://daily.dev/posts/your-api-can-be-authenticated-and-still-be-insecure-4ikr7misu","datePublished":"2026-08-21T04:28:45.794Z","dateModified":"2026-09-13T20:50:25.088Z","author":{"@type":"Person","name":"Divyansh","url":"https://daily.dev/divyansh30","image":"https://media.daily.dev/image/upload/s--f9lbkpFv--/f_auto/v1744873189/avatars/avatar_JMQ4qarKTe7zPurSPRrzM","description":"Aspiring engineer with an interest in AI, tech and DevOps :)","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":970}},"image":"https://media.daily.dev/image/upload/s--VxlQO-Vz--/f_auto/v1787286526/posts/4iKR7MIsU?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/sanjay","name":"DevOps & Platform Engineering Hub"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps & Platform Engineering Hub","item":"https://daily.dev/squads/sanjay"},{"@type":"ListItem","position":3,"name":"Your API Can Be Authenticated and Still Be Insecure"}]} ```