What You Will Learn

• Why internal APIs still need security.
• Common service-to-service authentication patterns.
• How token propagation works.
• Where API gateways and service meshes fit.
• Production safeguards for microservices.

Introduction

Internal traffic is not automatically trusted.

In microservice systems, every service should prove who it is and what it is allowed to do.

Common Patterns

Pattern	Purpose
Service JWT	Service identity and authorization
Token propagation	Pass user context downstream
mTLS	Authenticate services with certificates
API gateway	Centralized edge security
Service mesh	Traffic security between services

Service-to-Service Flow

sequenceDiagram
    participant User
    participant API as API Gateway
    participant Orders
    participant Payments
    User->>API: Request with user token
    API->>Orders: Forward validated context
    Orders->>Payments: Service call with service token
    Payments-->>Orders: Payment result
    Orders-->>API: Response

Token Propagation

Token propagation passes user identity to downstream services.

Use it when downstream services need to know:

• User ID.
• Tenant.
• Roles or scopes.
• Correlation ID.

Avoid blindly forwarding tokens to every service.

Service Tokens

Service tokens identify the calling application.

Example scopes:

orders.read
payments.create
claims.update

Production Practices

• Authenticate every service call.
• Authorize by scope or permission.
• Use TLS for transport.
• Add correlation IDs.
• Log caller service identity.
• Set timeouts and retries carefully.
• Avoid sharing long-lived secrets.

Summary

Microservice security requires identity, authorization, encrypted transport, auditability, and least privilege between services.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: Method-Level Security with PreAuthorize
• Next: mTLS Authentication between Java Services