A lock on every door of the stall (security inside a design)

The counter where two services meet across a written menu. This lesson walks round the back of that counter and asks which doors still check who is asking.

Before you start. From The Contract at the Counter (API design) you need the API, the written menu of what a caller may ask for, and its two refusals: 401 means “I don’t know who you are”, 403 means “I know who you are, and no”. From Authentication, a login hands you a badge (a token) whose stamp stops matching if anyone edits it. From Authorization & Identity, the second question every request must answer: “is this thing yours?” Transport & Network Security gave TLS, the lock on the line that stops anyone between a phone and a server from reading along, and The bouncer at the door (rate limiting) gave the man on the door who counts requests per customer.

The idea in 30 seconds

An API gateway is one front door that checks callers and routes requests, but every service behind it must still check the caller itself, because not every path runs through the front door.
Zero trust means no request is trusted for where it came from; each proves who sent it, and each service checks the thing asked for is that caller’s.
TLS termination is where the encrypted connection ends; traffic behind it can be read unless it is encrypted again.
Tenant isolation keeps each customer business’s data from the others, and the tenant must come from the signed login token, never from a value the caller typed.
Passwords and keys belong in a secrets manager that hands them out, logs who took them and can replace them fast, not in code.
Limits per network address fail against a caller rotating thousands of addresses; limits per signed-in caller on different records read catch scraping.

Read the story · Skip to the numbers