Skip to main content
R
RandyCF
Participant
March 21, 2018
Question

Api Manager Security

  • March 21, 2018
  • 1 reply
  • 329 views

Hello,

I have read that the Api Manager helps with security.  As I understand it that people will connect to the api manager endpoint and is authenticated. Then the request is passed over to my API.  Is this correct?

How is security handled between the api manager and my api?  do I just hide my api server non web accessible so it only accepts request from the api manager?

That part is still foggy to me.

Thank You,

Randy

This topic has been closed for replies.

1 reply

I
ImmanuelNoel
Participating Frequently
March 27, 2018

Hi Randy,

You are correct. API Manager acts as a proxy between the user and your API, ensuring requests that are directed to your API are actually authenticated and authorized.

You have two options to ensure your API is never actually accessed directly by your users. API Manager supports endpoint authentication via "Client Authentication" or "Shared Secret". Client Authentication is essentially support for two-way SSL. Shared Secret involves a secret token, known only to the API Manager and your API, to authenticate requests to your API. 

This is documented at, API Manager Publisher > "Specifying endpoints".

You could contact me at inoel@adobe.com, if you are interested in knowing more about this, or any other feature of API Manager. We would be happy to help you setup a robust environment.

- Immanuel

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices