Two credentials, two threat models: auth for a content API

A headless content API has two kinds of callers, and it's tempting to secure them the same way....

Raccontata dadev.to