Authenticating API requests

You can authenticate API requests in webMethods Integration by using personal or service ID API keys for secure access and integration.

Before you begin

To create API keys, you must have a service admin role.

About this task

webMethods Integration uses API keys to authenticate your HTTP API requests. An API key is a unique identifier that is used to authenticate and authorize access to an application programming interface (API).
API keys can be categorized into the following types based on their usage and access level:
  • Personal. Personal API key works based on the user’s role and permissions. It gives access according to what the user is allowed to do.
  • Service ID. The Service ID API key is not associated with any user. It works based on the Service ID that it belongs to.
    Note: When authenticating public API requests, a service ID API key supports only execution use cases and does not allow CRUD operations (Create, Read, Update, Delete). To perform CRUD operations, you must use a personal API key.

You create API keys using the IBM SaaS Console. Before you can generate an API key for an application or service, you must create a Service ID for that app or service in the IBM SaaS Console.

Procedure

  1. To create an API key in webMethods Integration, access the main menu from the home page.
  2. Select Access management to open the IBM SaaS Console.
  3. Choose your subscription.
  4. On the Subscriptions page, click View instances.
  5. In the table on the Instances tab, click the instance row where you want to add the API key.
    The Instance details page is displayed along with the Service IDs and API Keys tabs.
  6. Go to the Service IDs tab to create the service IDs and the API Keys tab to generate the API keys.

    For detailed steps on how to create API keys and Service IDs in the SaaS Console, see Granting access through service IDs and API keys from the IBM SaaS console.

What to do next

After the keys are generated, configure the authorization details in the external client to access and interact with webMethods Integration.

For example, if you are using an external client such as Postman, set the Authorization type to API Key. Use X-INSTANCE-API-KEY as the Key name and provide the API key that is generated by using the SaaS Console as the Key Value. Postman includes the X-INSTANCE-API-KEY in the HTTP request header, which acts as credentials for authenticating the incoming request. If you use another HTTP client, pass the X-INSTANCE-API-KEY as an HTTP header and set the API key as its value. The key acts like a password to verify the client's identity and ensure that they have permission to access the data or services.