Which model does IdentityNow's v3 REST APIs utilize for authorization?

• A. Basic Authentication
• B. OAuth 1.0
• C. OAuth 2
• D. OpenID Connect

Answer: (C)

IdentityNow's v3 REST APIs utilize the OAuth 2.0 model for authorization due to its robust framework designed for secure delegated access. OAuth 2.0 allows third-party applications to obtain limited access to user accounts on an HTTP service, such as IdentityNow, without sharing the user's credentials. This is accomplished through a token-based authorization system, which enhances security and user experience by allowing users to authorize access without disclosing their passwords.

OAuth 2.0 is widely adopted in current web services because it provides various flows (or grants) for different scenarios, such as web applications, native applications, and server-side applications, making it highly versatile for modern API security needs. Additionally, it supports features like token expiration and revocation, adding another layer of security for identity management.

In contrast to other models like Basic Authentication, which relies on sending user credentials with each request and can expose sensitive information, OAuth 2.0 minimizes risk by using access tokens. Models like OAuth 1.0 and OpenID Connect, although related, are less commonly used for the specific context of API authorization in new applications compared to OAuth 2.0, making it the optimal choice for IdentityNow's architecture.