Abstract: Techniques for a service provider network to perform adaptive, step-up authentication for client devices that invoke privileged API calls for services. A client device may perform an initial authentication protocol with an identity service provider (ISP), and be provided with a JSON web token (token) that enables the user to interact with a service of the service provider network according to an access scope. When the service provider network receives an API call from the client device, the service provider network may determine that the API call is a privileged API call. The service provider network may further determine that the privileged API call is not permitted by the access scope of the token. The service provider network may then require that the client device perform a step-up authentication process with the ISP to obtain another token with an elevated access scope to invoke the privileged API call.