- Welcome to Part 6 of the Authentication & Identity Security series.
- This article explains how APIs are authenticated and protected in enterprise environments.
- Designed for Middleware, DevOps, Cloud, API, and Application Support Engineers.
- Includes examples using API Keys, Basic Authentication, JWT, OAuth2, API Gateway, Azure API Management, NGINX, and backend services.
Table of Contents
- Introduction
- What is API Authentication?
- Why API Authentication is Important
- Common API Authentication Methods
- API Key Authentication
- Basic Authentication
- JWT Bearer Token Authentication
- OAuth2 API Authentication
- OAuth2 vs JWT
- What is an API Gateway?
- API Gateway Security Controls
- Enterprise Architecture Example
- Azure API Management Example
- NGINX / Reverse Proxy Example
- Authentication Method Comparison
- Common API Authentication Issues
- Best Practices
- Key Takeaways
- What’s Next?
Introduction
In Part 5, we compared JWT, Sessions, and Cookies. Now we will move one level deeper into API security.
Modern applications commonly expose REST APIs for mobile apps, web apps, partner integrations, microservices, automation tools, and cloud platforms. These APIs must be protected so that only trusted users, systems, or applications can access them.
API Authentication verifies who is calling the API before allowing access to backend services.
What is API Authentication?
API Authentication is the process of verifying the identity of a client application, user, service account, or system before allowing it to call an API.
API consumers may include:
- Web applications
- Mobile applications
- Partner systems
- Microservices
- Automation scripts
- CI/CD tools
- Monitoring tools
Simple API Flow
Client Application
│
▼
Authentication Credential
│
▼
API Gateway / API Server
│
▼
Credential Validation
│
▼
Backend Service Access
Why API Authentication is Important
APIs expose business data and backend functions. Without proper authentication, attackers or unauthorized systems may call sensitive APIs.
- Protects customer and business data
- Prevents unauthorized API access
- Supports audit and compliance requirements
- Protects backend services from misuse
- Enables secure partner and system integration
- Supports identity-based access control
In production environments, APIs are usually protected using a combination of authentication, authorization, rate limiting, logging, WAF, and API Gateway policies.
Common API Authentication Methods
| Method | Common Usage | Security Level |
|---|---|---|
| API Key | Simple application identification | Basic |
| Basic Authentication | Legacy/internal APIs | Low to Medium |
| JWT Bearer Token | Modern APIs and microservices | High |
| OAuth2 | Enterprise delegated access | High |
| mTLS | System-to-system authentication | Very High |
API Key Authentication
API Key authentication uses a unique key to identify the application or client calling the API.
Example
GET /api/customer HTTP/1.1 Host: api.company.com x-api-key: 9f8a7b6c5d4e
The API Gateway or backend API validates the key before processing the request.
Advantages
- Simple to implement
- Useful for internal or low-risk APIs
- Good for identifying applications
Limitations
- Does not identify the actual user
- Can be leaked if stored insecurely
- Should not be used alone for sensitive APIs
Basic Authentication
Basic Authentication sends username and password encoded in the Authorization header.
Example
Authorization: Basic base64(username:password)
Although the value is encoded, it is not encrypted. Therefore, Basic Authentication must always be used only over HTTPS.
Basic Authentication is simple but not recommended for modern public APIs unless combined with HTTPS, strong password policy, and additional controls.
JWT Bearer Token Authentication
JWT Bearer Token authentication is commonly used in modern APIs.
After successful login, the client receives a JWT access token and sends it with every API request.
Example API Request
GET /api/policies HTTP/1.1 Host: api.company.com Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Validation Performed by API
- Validate token signature
- Check token expiry
- Validate issuer
- Validate audience
- Check user roles or claims
JWT validation can be performed at API Gateway, reverse proxy, application middleware, or backend service level.
OAuth2 API Authentication
OAuth2 is commonly used when an application needs delegated access to protected APIs.
Instead of sharing user passwords with APIs, the application receives an access token from an authorization server.
OAuth2 API Flow
Client Application
│
▼
Authorization Server
│
▼
Access Token Issued
│
▼
API Request With Bearer Token
│
▼
Protected API
Common OAuth2 Components
- Client: Application requesting access
- Resource Owner: User or account owner
- Authorization Server: Issues tokens
- Resource Server: API being accessed
OAuth2 is commonly used with Azure Entra ID, identity providers, API Gateways, and enterprise SSO platforms.
OAuth2 vs JWT
Many engineers confuse OAuth2 and JWT and assume they are the same thing. They are related but serve different purposes.
OAuth2 is the process used to obtain access tokens.
JWT is a token format commonly used for those access tokens.
Airport Analogy
- OAuth2 = Security verification process
- JWT = Boarding pass issued after verification
OAuth2 Flow
User │ ▼ Application │ ▼ Authorization Server │ ▼ User Login & Consent │ ▼ Access Token Issued
JWT Example
Header.Payload.Signature
JWT defines the structure of the token. OAuth2 defines how the token is obtained.
Azure Example
User │ ▼ Microsoft Entra ID │ OAuth2 Authorization Flow │ ▼ JWT Access Token │ ▼ Azure API Management │ ▼ Backend API
| OAuth2 | JWT |
|---|---|
| Authorization Framework | Token Format |
| Defines how tokens are obtained | Defines token structure |
| Handles login and consent flow | Contains claims and signature |
| Can issue JWT or opaque tokens | Does not define login process |
| Used by Entra ID, Okta, Keycloak | Common access token format |
OAuth2 is an authorization framework that defines how applications obtain access tokens. JWT is a token format commonly used to represent those access tokens.
What is an API Gateway?
An API Gateway is a centralized entry point for APIs. It sits between clients and backend services.
Client │ ▼ API Gateway │ ▼ Backend API / Microservice
Instead of exposing backend services directly, organizations expose APIs through an API Gateway.
Common API Gateway Products
- Azure API Management
- AWS API Gateway
- Apigee
- Kong Gateway
- NGINX
- IBM API Connect
API Gateway Security Controls
API Gateways provide multiple security and governance controls.
- API authentication
- JWT validation
- OAuth2 integration
- API key validation
- Rate limiting
- IP whitelisting
- Request validation
- Header validation
- WAF integration
- Logging and monitoring
- Backend routing
- Throttling and quota management
Do not expose backend APIs directly to the internet. Use API Gateway, WAF, authentication policies, logging, and rate limiting.
Enterprise Architecture Example
Mobile App / Web App / Partner System
│
▼
WAF / CDN Layer
│
▼
API Gateway
│
┌────────┼────────┐
│ │ │
JWT Validation Rate Limit Logging
│ │ │
└────────┼────────┘
│
▼
Backend API Service
│
▼
Database / Core System
In this model, API Gateway validates the caller before forwarding traffic to backend services.
Benefits
- Centralized security enforcement
- Reduced backend exposure
- Improved monitoring and auditability
- Better control over partner integrations
- Reusable authentication and authorization policies
Azure API Management Example
Azure API Management can secure APIs using subscription keys, JWT validation, OAuth2 integration, and backend policies.
Typical Flow
Client Application
│
▼
Azure API Management
│
▼
Validate JWT / API Key
│
▼
Azure App Service / AKS / VM API
Common Azure API Management Controls
- Subscription key validation
- JWT validation policy
- OAuth2 / OpenID Connect integration
- IP filtering
- Rate limiting
- Request and response transformation
- Backend routing
JWT Header Example
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
NGINX / Reverse Proxy Example
NGINX can be used as a reverse proxy in front of backend APIs. It can enforce TLS, route traffic, validate headers, limit requests, and integrate with authentication services.
Client │ ▼ NGINX Reverse Proxy │ ▼ Tomcat / JBoss / Spring Boot API
Common NGINX API Security Use Cases
- HTTPS termination
- Header forwarding
- Rate limiting
- IP allowlist / denylist
- Reverse proxy routing
- Basic authentication for internal APIs
Authentication Method Comparison
| Method | Best For | Strength | Limitation |
|---|---|---|---|
| API Key | Application identification | Simple and fast | Does not identify user |
| Basic Auth | Legacy/internal APIs | Easy to implement | Password exposure risk if misused |
| JWT | Modern APIs | Stateless and scalable | Token theft and expiry handling |
| OAuth2 | Delegated access | Enterprise-grade authorization | More complex setup |
| mTLS | System-to-system APIs | Strong certificate-based trust | Certificate lifecycle management |
Common API Authentication Issues
| Issue | Possible Cause |
|---|---|
| 401 Unauthorized | Missing, expired, or invalid token |
| 403 Forbidden | User authenticated but not authorized |
| Invalid API key | Wrong key or inactive subscription |
| Invalid JWT signature | Wrong signing key or modified token |
| Audience validation failed | Token issued for different API |
| Rate limit exceeded | Too many requests from client |
| CORS issue | Browser blocked cross-origin API request |
Best Practices
- Always use HTTPS for API communication.
- Do not expose backend APIs directly to the internet.
- Use API Gateway for centralized authentication and policy enforcement.
- Use JWT or OAuth2 for modern APIs.
- Keep access tokens short-lived.
- Validate issuer, audience, expiry, and signature.
- Use API keys only for application identification or low-risk APIs.
- Apply rate limiting and throttling.
- Log API access for audit and troubleshooting.
- Use WAF for internet-facing APIs.
- Rotate secrets, API keys, and certificates regularly.
Key Takeaways
- API Authentication verifies who is calling the API.
- API Keys are simple but not enough for sensitive APIs.
- Basic Authentication should be avoided for modern public APIs unless strongly protected.
- JWT Bearer Tokens are widely used for modern API authentication.
- OAuth2 is used for delegated access and enterprise integrations.
- API Gateways centralize authentication, routing, monitoring, and security policies.
- Azure API Management, NGINX, Apigee, Kong, and IBM API Connect are common gateway solutions.
What’s Next?
Part 7 – OAuth2, OpenID Connect (OIDC) & SAML Explained
In the next article, we will understand OAuth2, OIDC, and SAML, and how these protocols are used in enterprise SSO, API access, and identity federation.
Series: Authentication & Identity Security for Middleware, DevOps & Cloud Engineers
Author: Pradeep V
Blog:
MiddlewareBox.com
