OAuth Authentication for an Administrator API
A developer prepares an API to be used by administrators. API requires username and password to be verified for validated access to data, however username-password combination of users must not be sent to the API service itself. Authentication and authorization will be provided over the same mechanism. Which authentication mechanism must be used by the API service?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
OAuth splits the credential check (authorization server) from API access (token), so the API service never sees the password. Basic and Digest both deliver a credential-based secret to the API itself, which the requirement explicitly forbids.
The API must verify administrators without ever receiving their username-password, so the credentials stay with an authorization server and only a token reaches the API. OAuth issues that access token, providing authentication and authorization through the same mechanism.
Choosing Digest because it avoids clear-text passwords — but Digest still sends a credential-derived response to the API service, so it fails the rule that credentials must never reach the service.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
OAuth is the only mechanism that keeps the administrator's username-password away from the API service entirely. The credentials are presented to an authorization server, which validates them and issues an access token that the API then trusts for both authentication and authorization. Because a single token carries identity and granted scope, OAuth satisfies the requirement that authentication and authorization be provided over the same mechanism while the password never crosses the wire to the API.Why the Other Options Are Wrong
Basic Authentication encodes 'user:password' in Base64 and sends it on every request, so the raw credentials reach the API service — precisely what the scenario forbids. Digest Access Authentication (RFC 7616) avoids sending the clear-text password, but it still transmits a hash derived from the credential to the API as part of the challenge-response exchange, so a credential-based secret still arrives at the service. API Key Authentication identifies the calling application with a static shared secret and says nothing about verifying an individual administrator's username-password, and it cannot perform authorization as the same mechanism.Community Comment Notes
Most voters selected OAuth, noting it relies on access tokens issued by an authorization server after the user's credentials are verified, so the token rather than the password is used for API access. One commenter argued for Digest Access Authentication citing RFC 7616, but that reasoning addresses password secrecy on the wire rather than the requirement that the username-password never be sent to the API service.Official Reference
Exam Strategy
Anchor on the phrase 'must not be sent to the API service itself' — it eliminates every option that transmits a credential or credential derivative to the API. OAuth's token delegation is the discriminator; remember that Basic sends the password and Digest sends a password-derived hash, so neither qualifies.
Frequently Asked Questions
Why can't Basic or Digest authentication be used when the password must not reach the API?
Basic sends the Base64-encoded username-password on every request, and Digest sends a hash derived from the credential, so both deliver a credential-based secret to the API service.
Does OAuth satisfy both authentication and authorization in this scenario?
Yes. The authorization server authenticates the administrator and issues an access token whose scope represents authorization, so one mechanism covers both.
Related Analysis
Practice All 200-901 Questions
Access 105 questions with complete answers and detailed explanations.
View Full 200-901 Practice Test →