For interservice calls a firewall is much more secure than any auth system, way less vectors of attack. Encrypted transport on public networks should be a given anyway, although if you have a private network then that is unnecessary also.<p>The only place auth is needed is for services that interact with users, and that works well in the microservice philosophy having an auth service which talks to all services as in user &lt;-&gt; service &lt;-&gt; auth<p>You can scale the auth system indirectly to the other services, and since auth is required almost everywhere means that you&#x27;ll have a large part of your resources devoted to that.<p>Where it gets interesting is when you use external microservices for auth like stormpath - is it a good idea to talk to that directly, or use a mediation auth service of your own - I usually prefer the 2nd method since while there is an extra hop - it makes the api more static and allows you to swap out what your app uses for auth much more easily.