OAuth Authentication for an Administrator API
Short answer
A OAuth is required because the API trusts authorization-server tokens, so the administrator's username-password is never sent to the API service itself.
Question
Key Takeaways
OAuth splits the credential check (authorization server) from API access (token), so the API service never sees the password. Basic and Digest both deliver a credential-based secret to the API itself, which the requirement explicitly forbids.
The API must verify administrators without ever receiving their username-password, so the credentials stay with an authorization server and only a token reaches the API. OAuth issues that access token, providing authentication and authorization through the same mechanism.
Common mistake: Choosing Digest because it avoids clear-text passwords — but Digest still sends a credential-derived response to the API service, so it fails the rule that credentials must never reach the service.
Expert Analysis
Why the Answer Is Correct
OAuth is the only mechanism that keeps the administrator's username-password away from the API service entirely. The credentials are presented to an authorization server, which validates them and issues an access token that the API then trusts for both authentication and authorization. Because a single token carries identity and granted scope, OAuth satisfies the requirement that authentication and authorization be provided over the same mechanism while the password never crosses the wire to the API.
Why the Other Options Are Wrong
Basic Authentication encodes 'user:password' in Base64 and sends it on every request, so the raw credentials reach the API service — precisely what the scenario forbids. Digest Access Authentication (RFC 7616) avoids sending the clear-text password, but it still transmits a hash derived from the credential to the API as part of the challenge-response exchange, so a credential-based secret still arrives at the service. API Key Authentication identifies the calling application with a static shared secret and says nothing about verifying an individual administrator's username-password, and it cannot perform authorization as the same mechanism.
Community Comment Notes
Most voters selected OAuth, noting it relies on access tokens issued by an authorization server after the user's credentials are verified, so the token rather than the password is used for API access. One commenter argued for Digest Access Authentication citing RFC 7616, but that reasoning addresses password secrecy on the wire rather than the requirement that the username-password never be sent to the API service.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
Anchor on the phrase 'must not be sent to the API service itself' — it eliminates every option that transmits a credential or credential derivative to the API. OAuth's token delegation is the discriminator; remember that Basic sends the password and Digest sends a password-derived hash, so neither qualifies.
Frequently Asked Questions
Why can't Basic or Digest authentication be used when the password must not reach the API?
Does OAuth satisfy both authentication and authorization in this scenario?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Erfan 👍 2 Answered AIt should be OAuth Authentication . Correct Answer: A
-
daniii89 👍 1 Answered AIts A: OAuth authentication provides a secure method for authentication and authorization without exposing user credentials (username-password) to the API service. Instead, OAuth relies on access tokens issued by an authorization server after verifying the user’s credentials. These tokens are then used for API access, ensuring security while preventing direct transmission of username-password combinations.
-
liketopass 👍 1 Answered BRFC 7616. This method enhances security by avoiding the transmission of passwords in clear text. It employs a challenge-response mechanism that uses a cryptographic hash function, ensuring that passwords are never sent directly over the network.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 200-901 Questions
Access 105 questions with complete answers and detailed explanations.
View Full 200-901 Practice Test →