Supported Inbound and Outbound Authentication
APEX acts as a gateway between your consumers and your upstream server. Authentication is configured at two points:
- Inbound — how consumers authenticate to the APEX Gateway when calling your API
- Outbound — how the APEX Gateway authenticates to your upstream server
Inbound authentication
Inbound auth is set when creating the API and can only be edited when the API is in draft/unpublished state. It determines what credentials consumers must present to call your API.
JWT Auth (APEX Recommended)
JWT Auth is recommended for sensitive APIs. Consumers generate a short-lived JWT signed using ES256 (Elliptic Curve P-256), attach it to the x-apex-jwt request header, and APEX validates the signature against the consumer’s JWKS endpoint or uploaded public key.
API Key
API Key auth is suitable for read-only, non-sensitive APIs. Consumers pass an API key as a request header or query parameter. It is simpler to implement than JWT but offers less security, and is best paired with additional controls such as TPS throttling at the application level and regular key rotation.
OAuth 2.1
OAuth 2.1 is recommended for APIs that require user consent, such as APIs accessing personal data on behalf of a user. Consumers obtain a bearer token from the OAuth authorization server and pass it in the Authorization header. APEX verifies the token using the Verify JWT request policy. Consumers must onboard to OAuth 2.1 via the APEX Portal before they can access APIs protected by this method.
Outbound authentication
Outbound auth is set on the API’s upstream server configuration. It determines how APEX authenticates to your upstream server after it has received and validated the consumer’s inbound request.
No Authentication
No credentials are added to the outbound request. APEX forwards the request to the upstream server as-is. This is appropriate when the upstream server is network-restricted and does not require additional authentication.
HTTP Basic
APEX attaches a username and password to the outbound request.
API Key (outbound)
APEX forwards an API key to the upstream server. The key can be passed as a header, query string parameter, or form parameter, depending on what the upstream server expects.
SSL / mTLS
You may add a client certificate (PFX/P12 format) to the upstream server during the TLS handshake, enabling mutual TLS. If the certificate is password-protected, the password must be provided.
Trust all certificates in chain: Select whether to trust all the CA certificates in the certificate chain. If this is not selected, only the top-level CA is trusted. This setting is selected by default.
OAuth (Microsoft)
This creates an outbound OAuth authentication with Microsoft Online OAuth service.
Provider Profile: Select Microsoft Profile
Token Key: ${authentication.subject.id}
You will need to include outbound parameters in order to complete this outbound authentication. Add the following outbound parameters as Parameter Type: header, and add in their respective values obtained from the Microsoft OAuth server:
- x_apex_tenantid
- x_apex_scope
- x_apex_clientid
- x_apex_secret
You can learn more about adding outbound override parameters in Manage Outbound Overrides.
AWS SigV4
You will need to include outbound parameters in order to complete this outbound authentication. Specify Generate_AWS_SigV4 as the request policy. The following parameters must be configured:
aws-access-key— AWS client access keyaws-secret-key— AWS client secret keyaws-service— AWS service name (e.g.execute-api)aws-host— AWS domain name or endpointaws-region— AWS region (e.g.ap-southeast-1)
Optional parameters:
aws-additional-signed-headers— (Optional) Additional headers to include in the signature, semicolon-delimited (e.g.header1;header2)
You can learn more about configuring AWS SigV4 outbound overrides in Handling AWS SigV4 Authorization.
