Apigee X API Security: API Keys, OAuth 2.0, JWT and mTLS

Welcome to a critical foundation of our course! In this lecture, we pull back the curtain on API security. APIs are the gateways to your data and services, making them a prime target for attackers. Understanding how to protect them isn't just a technical skill—it's a business necessity. ?️

This session is designed to give you a clear, comprehensive overview of the modern threat landscape. We'll move beyond theory and look at the real-world vulnerabilities that can expose organizations to significant risk.

What You'll Learn

• The "Why": Understand why APIs have become a favorite target for malicious actors and the potential impact of a security breach.

• Core Principles: Grasp the fundamental concepts of API security, including authentication, authorization, and data encryption.

• Identify Common Threats: Learn to recognize the most critical security risks as defined by the OWASP API Security Top 10, the industry standard for API vulnerabilities.

• Proactive Mindset: Begin to think like an attacker to better anticipate and defend against potential threats.

  By the end of this lecture, you'll have the foundational knowledge needed to approach API management with a security-first mindset. Let's get started!

Ready to master the gold standard of API security? In this lecture, we move beyond the basics and take a deep dive into the two most important technologies in modern application security: OAuth 2.0 and JSON Web Tokens (JWT).

Understanding how these frameworks operate is no longer optional—it's a core skill for anyone managing or building APIs. We'll demystify the entire process, from the initial user consent to the final, secure API call, so you can implement security policies with confidence. ?

What You'll Learn

• Master the Framework: Confidently explain the four key roles in the OAuth 2.0 framework (Resource Owner, Client, Authorization Server, Resource Server).

• Differentiate Grant Types: Understand the difference between common OAuth 2.0 grant types and know exactly when to use each one (e.g., Authorization Code vs. Client Credentials).

• Decode JWTs: Learn to read and understand the three-part structure of a JSON Web Token: the Header, the Payload (including claims), and the Signature.

• Connect the Concepts: Grasp the relationship between the OAuth 2.0 framework, OpenID Connect (OIDC) for identity, and the JWTs that carry the information.

By the end of this deep dive, you won't just know what OAuth 2.0 and JWT are—you'll understand how they work together to secure the modern internet.

Download the Lab05 Part 1 Guide (PDF) to implement API Key validation policies and enforce basic access control.

Lab Objective

Your goal is to take an open, unsecured API proxy and protect it. By the end of this lab, your API will reject all anonymous traffic and will only respond to requests that include a valid API key.

What You'll Do Step-by-Step

1. Create an API Product: You will bundle your API proxy into a product. This is the core Apigee concept for managing and controlling access to your APIs.

2. Register a Developer & App: We will simulate the developer onboarding process. You'll create a developer account and register a new "app" that will be used to consume your API product.

3. Generate and Retrieve an API Key: You will see how Apigee automatically generates a unique consumer key (the API key) for the app you just registered.

4. Apply the Security Policy: This is the key step. You will navigate to your API proxy's policy editor and add the "Verify API Key" policy to the request flow.

5. Test Your Secured API: Using a tool like the curl command or Postman, you will test your endpoint. You will first make a call without the key to confirm it's blocked (receiving a 401 Unauthorized error) and then make a successful call with the key to see it work perfectly.

By completing this lab, you'll have successfully implemented a foundational security control and will fundamentally understand how Apigee manages the relationship between API products, developers, apps, and security. Let's get building!

Download and follow the Lab05 Part 2 Guide (PDF) for implementing OAuth 2.0 authorization flows.

our goal is to configure a full OAuth 2.0 flow. You will build a dedicated endpoint to generate access tokens and then secure your primary API proxy so that it only accepts requests that present a valid token.

What You'll Do Step-by-Step

1. Update the API Product: You will modify your API Product, disabling the simple API key approval and enabling it for the OAuth 2.0 flow.

2. Build the Token Endpoint: You will add the OAuth-v2 policy to an API proxy and configure its GenerateAccessToken operation. This creates the endpoint (e.g., /oauth/token) that applications will call to exchange their credentials for a bearer token.

3. Secure the Main API: On your primary "hello-world" proxy, you will replace the API Key policy from Part 1 with a new OAuth-v2 policy. This time, you'll use its VerifyAccessToken operation to validate incoming tokens.

4. Execute the Two-Step Flow:

   • Step 1: Using curl or Postman, you will make a POST request to your token endpoint, sending the app's client_id and client_secret to receive a valid access token.

   • Step 2: You will then use that token in the Authorization: Bearer header to make a successful call to your now-protected API.

Prerequisites

• Familiarity with the concepts from Part 1. You will need the API product, developer, and app you created previously.

By the end of this lab, you will have implemented one of the most common and important API security patterns used in the industry today. You'll have practical, hands-on experience with the complete token generation and validation lifecycle in Apigee.

Download and Use the Lab05 Part 3 Guide (PDF) to validate JWT tokens within your API proxy using the VerifyJWT policy.

Your goal is to completely replace the OAuth 2.0 scheme from the previous lab with a modern, secure JWT flow. This involves removing all legacy OAuth 2.0 components for clarity and implementing a robust two-policy approach to handle JWTs according to Apigee's best practices.

What You'll Do Step-by-Step

1. Clean Up Your Proxy: First, you will remove the OAuth-v2 policies from the previous lab to create a clean slate for our new JWT implementation.

2. Generate a JWT with Assign Message:

   • On your token endpoint, you will use the Assign-Message policy.

   • Inside this policy, you'll leverage Apigee's built-in createJWT() function to dynamically generate a signed JWT.

   • You will define the token's header, payload (claims), and specify the private key used for signing.

3. Validate the JWT:

   • On your main API proxy, you will add the Verify-JWT policy.

   • You will configure this policy to use the corresponding public key to cryptographically verify the token's signature.

   • You'll also add checks to validate claims like the expiration time (exp) to prevent replay attacks.

4. Test the Full Lifecycle:

   • Step 1: You will call your token endpoint to generate a new, signed JWT.

   • Step 2: You will take this token and use it in the Authorization: Bearer header to make a successful call to your protected API, proving the validation is working correctly.

     By the end of this lab, you'll understand how to build a complete, self-contained token-based security system entirely within Apigee, giving you a powerful and flexible alternative to traditional OAuth.

Download both PDFs below:
• Part 4 Guide — details mTLS setup for secure mutual authentication.
• Complete Lab Guide (Parts 1–4) — consolidates the entire security workflow.

This lab simulates a real-world enterprise workflow by dividing tasks between two distinct roles: the Cloud Network Admin, who configures the infrastructure, and the API Developer, who consumes the secured endpoint. This approach reflects the separation of duties common in large organizations. ☁️

Your goal is to secure an API proxy with mutual TLS (mTLS) by configuring a Google Cloud Load Balancer that sits in front of Apigee X. This ensures that only clients presenting a trusted certificate can establish a connection, with the GCLB handling the TLS termination and validation.

What You'll Do (Simulating Two Roles)

This lab is a collaborative exercise where you'll perform tasks from two different perspectives.

The Cloud Network Admin's Role ?‍?

(Configuring the Infrastructure)

1. Manage Trust in Certificate Manager: You will upload a Certificate Authority (CA) root certificate to Google Cloud's Certificate Manager. This CA will be the source of truth for which client certificates the load balancer should trust.

2. Create a Client TLS Policy: You will define a Client TLS Policy for the load balancer. In this policy, you will enable mTLS and instruct it to use the CA from Certificate Manager for validating incoming client certificates.

3. Enforce the Policy: You will attach this new Client TLS Policy to the load balancer's target HTTPS proxy, effectively activating mTLS for all traffic destined for your Apigee instance.

The API Developer's Role ?‍?

(Testing the Connection)

1. Obtain Client Credentials: You will be provided with a client certificate and a corresponding private key, just as you would receive from a security team in a real project.

2. Test for Failure: You will first attempt to connect to the API endpoint using curl without providing the client certificate. You will observe that the connection is rejected at the TLS handshake level by the GCLB—it fails before ever reaching Apigee.

3. Test for Success: You will then execute the curl command again, this time presenting your client certificate and private key. The GCLB will validate your certificate against its truststore, establish a secure connection, and forward your request to the Apigee proxy, resulting in a successful API call.