Service-to-service identity
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
identify calling services safely.
Planned topics
- Client credentials:
ordershas its own client id and secret (stored in a secrets manager) and gets a token forinventory. - Token exchange: swap the user's token for a narrower token for the next service, keeping the user as subject.
- Choose: acting as the service (background, system tasks) versus acting for the user (user-specific data).
- One all-powerful service account is a common mistake; give each service only the scopes it needs.
- mTLS can add transport identity; it complements, not replaces, token checks.
Draft outline details
Demonstration
diagram: user → gateway → orders → (exchange) → inventory, with token subject and audience at each hop.
Check your understanding
Why not one shared service account?
Show answer
One leak exposes everything and nothing is traceable.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.