18F Authentication: Methods & Security Best Practices (2026)

Authentication overview

18F, a digital services agency within the U.S. General Services Administration (GSA), focuses on modernizing government technology. Its authentication mechanisms are tailored for secure access to internal and partner government systems, tools, and data. Unlike public-facing APIs, 18F's initiatives often involve integrating with existing government infrastructure or developing new solutions that adhere to stringent federal security standards. Authentication for 18F-developed or supported systems typically aligns with federal information security policies, including those outlined by the National Institute of Standards and Technology (NIST) and GSA-specific requirements.

The primary goal of 18F's authentication strategies is to ensure that only authorized personnel and systems can access sensitive government data and services. This involves robust identity verification, access control, and adherence to principles of least privilege. Developers working on 18F projects, whether internal or external contractors, are guided to implement authentication patterns that protect against unauthorized access and maintain the integrity of government operations. The specific authentication flow can vary significantly depending on the project's scope, the systems being integrated, and the sensitive nature of the data involved. For an overview of their approach to government technology, refer to the 18F Guides on their website.

Supported authentication methods

18F projects commonly employ several authentication methods, selected based on the specific security requirements, user types, and integration points of each system. The emphasis is consistently on secure, standards-compliant approaches that minimize risk and comply with federal mandates.

• OAuth 2.0: Widely used for delegated authorization, OAuth 2.0 allows third-party applications to obtain limited access to a user's resources without exposing their credentials. This is particularly relevant for integrations where services need to interact on behalf of a user. The OAuth 2.0 specification is a foundational standard for API security.
• API Keys: For server-to-server communication or applications where a user context is not required, API keys provide a simpler, direct authentication mechanism. These keys are typically long, randomly generated strings that identify the calling application. They must be managed securely to prevent unauthorized access.
• JSON Web Tokens (JWT): Often used in conjunction with OAuth 2.0, JWTs are compact, URL-safe means of representing claims to be transferred between two parties. They are frequently used for authentication and information exchange, especially in stateless API architectures. The IETF RFC 7519 defines JWT.
• Multi-Factor Authentication (MFA): While not an authentication method in itself, MFA is a critical security layer often mandated for accessing 18F-supported systems. It requires users to provide two or more verification factors to gain access to a resource, significantly enhancing security.

Authentication Method Comparison

Getting your credentials

Accessing credentials for 18F-supported systems typically involves an internal process, as 18F does not offer public-facing API products with self-service credential generation. The process is project-specific and requires direct coordination with the relevant 18F team or the partner agency.

1. Project Onboarding: When joining an 18F project or initiating an integration, developers will be onboarded to the project's specific security and access protocols. This often includes understanding the system's architecture and designated authentication methods.
2. Access Request: Developers typically submit a formal request for credentials (e.g., client IDs, client secrets, API keys) through an internal ticketing system or directly to the project lead. This request will specify the required access scope and the justification for it.
3. Security Review: Requests are subject to security review to ensure compliance with federal guidelines and project-specific policies. This may involve verifying the developer's identity, role, and the security posture of the application or system requiring access.
4. Credential Issuance: Once approved, credentials are securely issued. This might involve direct provision by a security officer, or through a secure, encrypted channel. Developers are typically instructed on secure storage and handling of these credentials.
5. Environment-Specific Credentials: It is common practice to issue separate credentials for development, staging, and production environments. This minimizes the risk of production data exposure during development and testing phases.

For guidance on secure development practices within the government context, developers should consult the 18F guides and project-specific documentation.

Authenticated request example

While specific endpoints and credentials are project-dependent, an example of an authenticated request using an OAuth 2.0 bearer token demonstrates a common pattern for 18F-supported APIs. This example assumes an access token has already been obtained through an OAuth 2.0 flow.

GET /api/v1/resource HTTP/1.1
Host: example-18f-api.gov
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json

In this example:

• YOUR_ACCESS_TOKEN represents the OAuth 2.0 access token obtained after successful authorization.
• The Authorization header carries the bearer token, a standard method for transmitting access tokens.
• The Host header specifies the API endpoint, which would be specific to the 18F project.

For API key authentication, the pattern might look like:

GET /api/v1/data HTTP/1.1
Host: example-18f-api.gov
X-API-Key: YOUR_API_KEY
Content-Type: application/json

Here, YOUR_API_KEY is passed in a custom header, X-API-Key, a common convention for API key authentication. The exact header name may vary by project. Developers should always refer to the specific API documentation provided for their project.

Security best practices

Adhering to security best practices is paramount when working with 18F-supported systems, given the sensitive nature of government data. These practices align with federal security guidelines and industry standards.

• Secure Credential Storage: Never hardcode API keys or sensitive credentials directly into application code. Use environment variables, secure configuration files, or dedicated secret management services (e.g., AWS Secrets Manager, Azure Key Vault) for storing credentials. Rotate credentials regularly, as recommended by the project.
• Least Privilege: Grant only the minimum necessary permissions for an application or user to perform its intended function. Regularly review and revoke unnecessary access.
• Input Validation: Implement robust input validation on all data received by your application to prevent common vulnerabilities like SQL injection, cross-site scripting (XSS), and command injection.
• HTTPS/TLS Everywhere: Always use HTTPS/TLS for all communication with 18F-supported APIs to encrypt data in transit and prevent eavesdropping and man-in-the-middle attacks. Ensure that TLS certificates are valid and up-to-date. The Cloudflare guide to SSL/TLS provides a good overview of this critical security layer.
• Error Handling: Implement secure error handling that avoids exposing sensitive information in error messages (e.g., stack traces, database details). Log detailed errors internally for debugging, but present generic messages to end-users.
• Logging and Monitoring: Implement comprehensive logging for all API interactions, authentication attempts (successes and failures), and critical system events. Use monitoring tools to detect and alert on suspicious activities or anomalies.
• Regular Security Audits: Conduct regular security audits, penetration testing, and code reviews of applications interacting with 18F systems. Address identified vulnerabilities promptly.
• Dependency Management: Keep all libraries, frameworks, and dependencies up to date to patch known security vulnerabilities. Regularly scan for and address potential weaknesses in third-party components.
• Session Management: For user-facing applications, implement secure session management, including strong session IDs, appropriate session timeouts, and invalidation of sessions upon logout or inactivity.
• Understand Federal Requirements: Familiarize yourself with relevant federal security mandates, such as NIST Special Publications (e.g., SP 800-53, SP 800-63), which provide comprehensive guidance on information security for federal systems. The NIST Computer Security Resource Center offers access to these publications.