Securing APIs with API Keys in WSO2 API Manager
Securing APIs with API Keys in WSO2 API Manager is a recent addition to the WSO2 API Manager. This is not available in 2.x and prior versions. Yet this is the simplest for of API security.
WSO2 API-M API Keys require an application subscription to use the API Key. In this video, we'll look at how to secure and invoke API using API Keys.
Most simplest form of application-based security for APIs
You can obtain an API key for a client application
API Key is a JSON Web Token (JWT) type token
Subscription validation is mandatory for API key validation
Keys generated before an application subscription to an API won’t work
API-M Gateway performs the following two basic validations.
Signature validation
Subscription validation
The public certificate of the private key that is used to sign the tokens should be added to the trust store under the "gateway_certificate_alias"
curl -k -X GET "https://localhost:8243/pizzashack/1.0.0/menu" -H "accept: application/json" -H "apikey: API_key_value"
curl -k -X GET "https://localhost:8243/pizzashack/1.0.0/menu?apikey=url_encoded_API_key_value"
keytool -export -alias wso2carbon -file wso2.crt -keystore wso2carbon.jks
keytool -import -trustcacerts -keystore client-truststore.jks -alias gateway_certificate_alias -file wso2.crt
ttps://www.urlencoder.org