[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-mutual-tls::en":3,"gloss-cluster-mutual-tls::en":26,"gloss-next-mutual-tls::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"mutual-tls","integration","Mutual TLS (mTLS)","Mutual TLS is ordinary TLS with the handshake run in both directions: the server presents a certificate the client verifies, and the client presents one the server verifies. Standard HTTPS authenticates only the server. It proves you are talking to the right host and says nothing about who is talking, and mutual TLS closes that second gap at the transport layer, before any application code runs. The practical appeal for a SaaS vendor is that it replaces a bearer secret with a key that never travels. An API key or a token is sent on every request and is therefore replayable by anyone who reads a log, a proxy buffer or a misconfigured error report. A client certificate keeps its private key on the client; the handshake proves possession without transmitting it. That is why regulated and enterprise buyers ask for it on machine-to-machine endpoints, and why it appears on service-to-service traffic inside networks that have stopped assuming the network itself is trustworthy. What it costs is certificate lifecycle. Someone has to issue certificates, distribute them, rotate them before they expire and revoke them when a client is decommissioned, and an expired client certificate fails closed, taking the integration down at a moment nobody scheduled. Expiry monitoring is not an optional extra here; it is the operational substance of the scheme. Two limits are worth stating plainly. Mutual TLS authenticates a client, it does not authorise one: the certificate identity still has to be mapped to a tenant and a permission set, or every valid certificate can reach everything. And terminating TLS at a load balancer or an edge network means the certificate identity has to be forwarded to the application deliberately, usually as a header, which then has to be stripped from untrusted inbound requests so it cannot be spoofed.","Mutual TLS authenticates both ends with certificates instead of a replayable bearer secret, and makes certificate expiry your standing operational job.",null,[11,14,17,20,23],{"slug":12,"name":13},"api-key","API Key",{"slug":15,"name":16},"encryption-in-transit","Encryption in Transit",{"slug":18,"name":19},"service-account","Service Account",{"slug":21,"name":22},"webhook-signing","Webhook Signing",{"slug":24,"name":25},"zero-trust","Zero-Trust Architecture",[27,31,34,37,40,43,47,50,53,56,59,62],{"slug":28,"category":5,"name":29,"updated_at":30},"backend-for-frontend","Backend for Frontend (BFF)","2026-08-24T02:46:38+00:00",{"slug":32,"category":5,"name":33,"updated_at":30},"concurrency-limit","Concurrency Limit",{"slug":35,"category":5,"name":36,"updated_at":30},"event-ordering","Event Ordering",{"slug":38,"category":5,"name":39,"updated_at":30},"field-mapping","Field Mapping",{"slug":41,"category":5,"name":42,"updated_at":30},"function-schema","Function Schema",{"slug":44,"category":5,"name":45,"updated_at":46},"grpc","gRPC","2026-08-24T02:46:37+00:00",{"slug":48,"category":5,"name":49,"updated_at":30},"integration-marketplace","Integration Marketplace",{"slug":51,"category":5,"name":52,"updated_at":30},"ip-allowlist","IP Allowlist",{"slug":54,"category":5,"name":55,"updated_at":30},"json-web-token","JSON Web Token (JWT)",{"slug":57,"category":5,"name":58,"updated_at":30},"mcp-server","MCP Server",{"slug":60,"category":5,"name":61,"updated_at":30},"oauth-scopes","OAuth Scopes",{"slug":63,"category":5,"name":64,"updated_at":30},"openapi-specification","OpenAPI Specification"]