Channel credentials secure the whole connection, such as TLS that encrypts traffic and proves the server's identity. Call credentials attach identity data, such as an OAuth token, to each individual call. Production services usually combine both, so the connection is encrypted and every request says who is asking.
Definitions
The gRPC authentication guide describes a simple API built around Credentials objects, which can be applied to an entire channel or to one call. It names two types:
- Channel credentials, attached to a channel. SSL or TLS credentials are the standard example.
- Call credentials, attached to a call. A token sent in call metadata is the standard example.
They can be composed. A composite channel credentials object pairs channel credentials with call credentials, so authentication data goes with every call on that channel. The guide's example creates channel credentials from SSL credentials and an access token credential, and the result sends the token on each call.
What each one protects
| Question | Channel credentials | Call credentials |
|---|---|---|
| Is traffic encrypted? | Yes, with TLS | No, depends on channel |
| Does the client verify the server? | Yes, with TLS | No |
| Who is the caller? | With client certificates, the service | The user or service named in the token |
| Can identity change per request? | No | Yes |
| Where checked on the server? | TLS layer | Interceptor or handler |
Think of the channel as the sealed envelope and the call credentials as the signed letter inside.
Why you want both
TLS alone proves the server is who it says and hides traffic. It does not say which user is calling unless you also use client certificates. A token alone, sent over plain text, can be read and replayed by anyone on the path.
The gRPC guide notes that most implementations will not let you send credentials on an unencrypted channel, and that the token mechanism must be used together with TLS on the channel. That default is a safety net, so avoid code that works around it.
OWASP's gRPC cheat sheet adds practical rules. Use TLS in production with version 1.2 or higher and strong cipher suites. For service to service traffic, use mutual TLS where both sides verify certificates. Use short lived tokens, 15 to 60 minutes as its example, with refresh. Pass credentials in metadata headers, not in method parameters. Validate tokens in a server interceptor. See also the post on which streaming calls an interceptor covers.
One warning from the guide
Google issued credentials should only be used to talk to Google services. The guide warns that sending a Google issued OAuth2 token to another service could let the token be stolen and used to impersonate the client. The general lesson: never send a token to a service that did not issue it or is not meant to receive it.
Setup checklist
- Enable TLS on every server. Do not leave a plaintext port in production.
- Make clients verify the server certificate against a trusted authority.
- Decide who the caller is: a user, a service, or both. Pick client certificates, tokens or both to match.
- Send tokens as call credentials in metadata, never as message fields.
- Validate tokens in a server interceptor and check expiry, audience and scopes.
- Keep tokens short lived and refresh them.
- Test with a missing token, an expired token and a token meant for another audience.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how API findings are grouped and ask which would relate to transport or per request identity.
Quick check
Is TLS enough to authenticate callers?
Not by itself. TLS authenticates the server and encrypts traffic. To identify the caller you need client certificates or per call credentials such as tokens.
Where should a token go in a gRPC call?
In call metadata, normally the authorization header, not in message fields. Validate it in a server interceptor.
Safeguard scans your dependencies and SBOMs for known vulnerabilities, including gRPC and TLS libraries. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
