An API gateway or API manager provides a facade to access back-end APIs. This kind of reverse proxy is deployed in many API-based infrastructures to ensure that access to back-end services is authenticated and authorized.
To make these determinations, the gateway needs proof of who the user or caller is. This is commonly done in a token-based manner, where the token represents the end user and includes information about the calling client application. To obtain such a token, organizations increasingly rely on OAuth 2 as the protocol that defines how tokens are issued. Once issued and presented to the API gateway, these tokens must then be validated.
Token issuance and validation are fundamentally different responsibilities, belonging to separate subsystems: Identity Management and API Management. Using the same product for both blurs that boundary, creating fragility, vendor lock-in, and technical debt that's difficult to undo, especially since API platforms are often built to last 5 to 10 years. Using the right tool for each job, on the other hand, keeps the platform loosely coupled and improves its chances of success over the long run.
Table of contents
Introduction — 1
Solving Hard Problems Through Decomposition — 2
The Differences Between Token Issuance and Validation — 4
Overview of Token Issuance — 4
Authentication, the Prerequisite to Token Issuance — 5
Validation, the Sole Responsibility of the API Gateway — 7
Conclusion — 10
For Further Information — 11
