Third-party to use Fusion HCM REST API - Suggestion on Authentication Method

Summary:

Suggestion on Authentication Method to be used for REST API authentication

Content (please ensure you mask any confidential information):

We are using Fusion HCM and need to grant REST API access to one third party customer to get worker information from Fusion HCM

As per the documentation currently the below methods are available.

•  Basic authentication (Should have the UserName and Password)
• SAML (Security Assertion Markup Language) 
• JWT (JSON Web Token) 

We are not planning to use the below methods due to the underlying security gaps

•  Basic authentication (Should have the UserName and Password) 

 - We cannot control how the third-party keeps the password, they might keep it as plain text which will be a risk