SnowPro Specialty: Gen AI Question 235
Single answerREST API authentication methodsA team is building a Snowflake-based generative AI application that calls an external REST API to retrieve embeddings before storing results in Snowflake. The security team requires an authentication method that avoids hard-coding usernames and passwords, supports short-lived credentials, and is commonly used for service-to-service API access. Which authentication method best fits these requirements?
- A
OAuth 2.0 bearer token authentication
- B
Basic authentication with a username and password stored in code
- C
API key passed as a query string parameter in the request URL
- D
No authentication, because the API is accessed only from a private network
Show answer and explanation
Correct answer: A
Explanation
The best answer is OAuth 2.0 bearer token authentication because the scenario emphasizes service-to-service access, avoidance of hard-coded credentials, and support for short-lived credentials. In modern REST API security, OAuth 2.0 access tokens are preferred over static credentials when delegated, scoped, or time-limited access is needed. Basic authentication uses long-lived username/password pairs and is generally less suitable for secure automated integrations. API keys may still be used by some services, but placing them in query parameters is discouraged because URLs are often logged; if API keys are used at all, headers are generally preferred. Industry best practices from OAuth 2.0 guidance and API security recommendations consistently favor short-lived tokens, TLS, least privilege, and credential rotation for production integrations.
- A. Correct.
Correct. OAuth 2.0 bearer token authentication is commonly used for service-to-service REST API access and supports short-lived access tokens, which reduces the risk associated with long-lived static credentials. It aligns with modern security best practices by avoiding hard-coded usernames and passwords and enabling token rotation, scoped access, and centralized identity management.
- B. Incorrect.
Incorrect. Basic authentication relies on a static username and password, which does not meet the requirement to avoid hard-coded credentials. Although it can work over TLS, it is generally less secure and harder to manage at scale than token-based approaches. This is a common misconception when teams prioritize simplicity over credential lifecycle management.
- C. Incorrect.
Incorrect. API keys can be valid for simple integrations, but passing them in the query string is not a best practice because URLs may be logged by clients, proxies, gateways, and monitoring tools. In addition, API keys are typically long-lived shared secrets and do not inherently provide the short-lived, delegated access model required in the scenario.
- D. Incorrect.
Incorrect. Private network access does not eliminate the need for authentication. Network controls are a layer of defense, but APIs that expose sensitive or billable operations should still authenticate callers. Choosing no authentication reflects a misunderstanding of defense-in-depth security principles.