Out-of-the-box security capabilities of APIC
When securing APIs with APIC, you are provided with three out-of-the-box security capabilities that can be applied. These are as follows:
- API key: This method involves configuring Client ID and Client Secret security definitions as part of defining an API. Once defined in the API's Security definition, a consumer may pass values for these API keys as part of a request's query (
X-IBM-Client-Id,X-IBM-Client-Secret) or header (client_id,client_secret). - Basic authentication: This option allows you to perform API authentication by validating the supplied credentials against an Authentication URL or an LDAP-based user registry.
- OAuth: The OAuth option allows us to secure APIs utilizing the standards set forth for OAuth2 (and OIDC).
These three capabilities should generally solve most of your API security concerns. When choosing between these security capabilities, you utilize a two-step process within an API...
