About Consuming APIs

This section covers how to authenticate and make requests to APIs published on the APEX Cloud API Gateway. The authentication method you need depends on how the API publisher configured their API’s inbound authentication.

Certificate prerequisites

APEX Cloud API Gateways are secured with certificates signed by AWS Public Root Certificate Authorities. Before making any API calls, ensure your application trusts the required AWS CA certificates. See Certificate Prerequisites for the full list of certificates to install.

Authentication methods

API Key — The simplest method; pass a key in a request header. Suitable for read-only, non-sensitive APIs
JWT Auth — Sign requests with a JSON Web Token for stronger authentication without user interaction
OAuth 2.1 — Authorize on behalf of a user (e.g. Corppass) using the Authorization Code Flow with PKCE

Configuring OAuth scopes

Certificate Prerequisites