Configuring application authentication for an API

Application authentication settings allow you to protect your API with a certificate. You can select whether a client certificate is sent as a TLS client certificate or in an HTTP header.

About this task

Note: This task relates to configuring an OpenAPI 3.0 API definition. For details on how to configure an OpenAPI 2.0 API definition, see Editing an OpenAPI 2.0 API definition.

You can complete this task either by using the API Designer UI application, or by using the browser-based API Manager UI.

At any time, you can switch directly to the underlying OpenAPI YAML source by clicking the Source icon OpenAPI Source icon. To return to the design form, click the Form icon Form icon.

Procedure

  1. Open the API for editing, as described in Editing an OpenAPI 3.0 API definition.
  2. Enable application authentication, as follows:
    Note: To identify the application, you must enable a security requirement of type clientID.
    1. Select the Gateway tab, expand Gateway and portal settings, then click Application Authentication.
    2. Select Certificate.
  3. Specify how the client certificate is sent to the gateway, as follows:
    1. In the navigation pane, click Application Authentication Source.
      Any existing application authentication source definitions are listed.
    2. Alongside Application Authentication Source, click Add.
    3. Select header.

      When the API is called, an X509 client certificate must be supplied in the specified HTTP header. For any Developer Portal application that calls the API, the certificate must be entered in the Developer Portal user interface; for details, see Registering an application.

      If you are using a load balancer, you must configure the load balancer to use the specified HTTP header to relay the appropriate client certificate to the Gateway service after the load balancer terminates the TLS communication.

  4. Click Create.
  5. Click Save to save your changes.