Securing service-to-service communication means each service must prove its identity to the others and encrypt data in transit, typically combining mutual trust tokens with transport-level encryption rather than relying on network isolation alone.
Key Points: • Services exchange short-lived tokens (JWTs or OAuth2 client-credentials tokens) to authenticate as themselves, not as an end user. • mTLS (mutual TLS) can additionally verify both endpoints' certificates for strong service identity. • All traffic should run over TLS to prevent eavesdropping or tampering, even inside a "trusted" internal network. • An API gateway or service mesh can centralize authentication, routing, and traffic policy across services. • Tokens should be scoped narrowly (least privilege) so a compromised service can't impersonate others broadly.
Example: The order-service calls the payment-service using an OAuth2 client-credentials token scoped to payments:write, and the connection runs over TLS so the token and payload can't be intercepted on the network.
Interview Tip: A concise interview answer is:
"I'd use OAuth2 client-credentials tokens or mTLS so each service can prove its identity to others, run everything over TLS to encrypt data in transit, and route traffic through an API gateway or service mesh for centralized policy enforcement. Scoping tokens narrowly limits the blast radius if one service is compromised."