Api Manager Security

[RandyCF]

Hello,

I have read that the Api Manager helps with security.  As I understand it that people will connect to the api manager endpoint and is authenticated. Then the request is passed over to my API.  Is this correct?

How is security handled between the api manager and my api?  do I just hide my api server non web accessible so it only accepts request from the api manager?

That part is still foggy to me.

Thank You,

Randy

[ImmanuelNoel]

Hi Randy,

You are correct. API Manager acts as a proxy between the user and your API, ensuring requests that are directed to your API are actually authenticated and authorized.

You have two options to ensure your API is never actually accessed directly by your users. API Manager supports endpoint authentication via "Client Authentication" or "Shared Secret". Client Authentication is essentially support for two-way SSL. Shared Secret involves a secret token, known only to the API Manager and your API, to authenticate requests to your API. 

This is documented at, API Manager Publisher > "Specifying endpoints".

You could contact me at inoel@adobe.com, if you are interested in knowing more about this, or any other feature of API Manager. We would be happy to help you setup a robust environment.

- Immanuel