Kerberos

Kerberos is a network authentication protocol that lets clients and services prove their identities to one another across an untrusted network without ever sending a password over the wire. Originally developed at MIT and standardized in RFC 4120 as version 5, it relies on tickets and symmetric-key cryptography mediated by a trusted third party, the Key Distribution Center (KDC). It remains the authentication backbone of enterprise environments, most visibly inside Microsoft Active Directory.

• Ticket-based authentication - A client obtains a time-limited ticket from the KDC and presents it to services, so credentials are never repeatedly transmitted.
• Key Distribution Center - A trusted KDC, split into an Authentication Server and a Ticket-Granting Server, brokers trust between every party in a realm.
• Symmetric-key cryptography - Shared secret keys, rather than public-key exchanges, secure the tickets and authenticators.
• Mutual authentication and single sign-on - Both client and service verify each other, and a single ticket-granting ticket underpins seamless SSO across many services.

In real API operations, Kerberos is most often the authentication layer behind internal and enterprise APIs — services fronted by Active Directory, SPNEGO-negotiated HTTP calls, and on-premises systems where a Kerberos ticket authorizes access. Modern web and agentic API traffic more commonly leans on OAuth 2.0, OpenID Connect, and JWT, so a frequent governance task is bridging Kerberos-authenticated backends to token-based front doors without weakening either side’s trust model.