Can I use a password for service-to-service auth?
No. Use API keys or mTLS. Passwords are for humans. Services do not type passwords; they use long random keys that do not expire on every request.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Password vs Token vs API Key: When to Use Which
Passwords for human login. Tokens (JWT) for session continuity after login. API keys for programmatic access from services, scripts, or third parties. Use all three based on the use case.
In an httpOnly, secure, sameSite cookie for web apps. In secure storage (Keychain, Keystore) for mobile apps. Do not use LocalStorage (open to XSS).
Hashed, like passwords. Send the raw key once on creation; the user stores it. Compare hashes on each request. If the database is leaked, attackers cannot use the hashes.
Still have questions?
Browse all our FAQs or reach out to our support team