API terminology
There is some terminology that we need to go through, to be able to understand all aspects of API management and API access management:
- API product: An application with a group of API endpoints. These endpoints can have different needs and use cases, but listen to the same authorization server to understand what a user or service can and cannot do. It also is the service that a user logs into using OpenID Connect with an ID token.
- API: These are the endpoints where data is available and interchangeable between systems depending on the request and resource and access grant.
- Authorization server: An authorization server is at its core an OAuth 2.0 minting machine, utilizing Okta's scopes, claims, and access policies. You can create authorization servers in Okta, typically one server per API product. The server is typically used for one use case rather than one endpoint.
- Scopes: Scopes are operations performed on your API endpoints. They are built...