Think about walking into an office building. Before you reach the elevator, someone at the front desk asks who you are, checks your name on a list, and hands you a badge. Only then can you go up.

Every request from a phone or a browser gets the same treatment. Something has to ask "who is this?" before the request gets anywhere near your data.

Many teams build a small service just to be that front desk. It works, but now there's one more service to build, run and keep up to date.

What that layer is really doing

When an API is open to end-user devices, a mobile app, a browser, an IoT sensor, the identity of the caller matters. Authentication has three jobs there:

Check that the call is legitimate

Keep sensitive data away from anyone who shouldn't see it

Tell the rest of the system who is asking, so later steps can act on it

The third one gets forgotten.…