IAM

IAM (Identity and Access Management) is the discipline, and the tooling behind it, for managing digital identities and governing what each identity is permitted to do. In an API context that means far more than logging users in — it covers the full lifecycle of users, services, and machine clients, the credentials they hold, and the policies that decide which resources and operations each one can reach.

• Authentication - Establishing who or what is making a request, from passwords and API keys to certificates and federated identity.
• Authorization - Deciding what an authenticated identity is allowed to do, expressed through roles, scopes, and fine-grained policies.
• Identity lifecycle - Provisioning, rotating, and de-provisioning identities and credentials so access reflects current reality, not stale grants.
• Machine and service identity - Treating applications, workloads, and agents as first-class identities, not just human users.
• Auditability - Producing the logs and trails needed to prove who accessed what, when, and under which policy.

In real API operations, IAM is where security, governance, and developer experience meet — it underpins OAuth flows, gateway authorization, and the least-privilege policies that keep an estate safe as it scales. It is one of the most crowded categories in the API tooling landscape, and the shift toward autonomous agents is raising the stakes: non-human identities now need the same rigor of authentication, scoping, and lifecycle management that we once reserved for people, often reinforced by primitives like HTTP Message Signatures.