Authentication

A practical example

Example: your team connects a marketing platform to a CRM.

With OAuth 2.0, each integration gets scoped tokens that a user can revoke centrally; with a static API key, a leaked credential in a notebook stays valid until someone manually rotates it.

What to evaluate before investing

• Ask whether the vendor supports OAuth 2.0 with scoped, short-lived tokens rather than only static keys.
• Check if credentials can be rotated without downtime and whether rotation is scriptable via API.
• Confirm whether SSO and enforced multi-factor authentication are included in your tier or cost extra.

Limitations and tradeoffs

Strong authentication does not cover what an authenticated integration is allowed to do; that is authorization.

Also, OAuth setups vary in scope granularity, so a vendor claiming OAuth support may still request broader access than your use case needs.