Four ways to say "this service is allowed."

WeldForge gives you four independent mechanisms for authenticating machines to machines — pick the one that matches the trust model of each integration, mix and match across tenants, and let the platform worry about rotation, scoping and revocation.

Start with API keys Or set up mTLS →

The four mechanisms

Simple

Prefixed API keys

A wf_live_… key your integrator pastes into an environment variable. Hashed at rest, returned exactly once on creation, optionally scoped to a path glob and a set of HTTP methods.

Use when: the other side is one service, the secret lives in a secret manager, and you want the simplest thing that could work.

RBAC-aware

Service-account tokens

Prefixed wf_svc_… tokens backed by a proper identity with an admin role, expiry, and audit trail. Unlike an API key, a service account can act as TENANT_ADMIN or READ_ONLY — so automations don't need a human's credentials.

Use when: the client is an automation (Terraform, CI/CD, a chatops bot) that needs admin-console capabilities.

Standard

OAuth 2.0 client credentials

Register an OIDC client, configure its grant types to include client_credentials, and your service exchanges its client id + secret for a short-lived JWT. Works with every OAuth2 library on earth.

Use when: the client is another OIDC-aware app or a third-party SaaS that already speaks OAuth2.

High assurance

Mutual TLS

Issue a client certificate from the tenant's internal CA, bind it to a user, and authenticate with the cert instead of a password. Revoked certs fail-fast through the CRL and OCSP responder.

Use when: you need cryptographic proof of identity at the transport layer — payment systems, healthcare, anywhere compliance demands it.

Scoped API keys

A key without a scope is a loaded gun. Every API key in WeldForge can be restricted to an Ant-style path pattern and a set of HTTP methods — if the call doesn't match, it's refused before any business logic runs.

{
  "clientName": "reporting-pipeline",
  "scopes": [
    { "path": "/api/admin/users/**",  "methods": ["GET"] },
    { "path": "/api/admin/audit/**",  "methods": ["GET"] }
  ]
}

The key above can read users and the audit log, nothing else. Compromise it and the blast radius stays small — and rotation is a single API call that returns a new wf_live_… value and invalidates the old hash immediately.

Circuit-broken everywhere

Every outbound dependency (Twilio, webhook receivers, SMTP, upstream IdPs, CRMs) runs inside a Resilience4j circuit breaker. If a downstream fails, the breaker opens and subsequent calls fast-fail instead of piling up on a struggling receiver — preserving latency for the requests that can succeed. Breaker state is exposed on /actuator/circuitbreakers and scraped into Prometheus out of the box.