Answers to common questions about securing APIs in API Gateway.
API security issues
API security
How do I ensure AppKey security for mobile terminals?
An AppKey identifies the caller of an API. It is sensitive credential data. Store it securely, never embed it in client-side code, and avoid exposing it in logs. If an AppKey is compromised, rotate it immediately in the API Gateway console.
An AppKey alone is an identity credential, not a strong authorization mechanism. For stronger security, combine AppKey authentication with request signing by using Backend signature plug-ins.
How do I ensure security for a call from API Gateway to the backend server?
Two options are available. For stronger protection, use both together.
-
Backend signature: Set a security key on the API. API Gateway signs outbound requests using a specified method, and your backend verifies the signature to confirm the request originates from the gateway.
For setup details, see Backend signature plug-ins.
Your backend must use the same signing method to verify incoming requests.
-
HTTPS: Encrypt the connection between the gateway and your backend.
Before enabling HTTPS, obtain a valid Secure Sockets Layer (SSL) certificate and configure it on your backend server.
Do I need to republish an API after I change the backend key for it?
No. Create the new key and bind it to the API in the console. The change takes effect without republishing.
How do I replace a backend key without interrupting services?
This procedure requires at least two backend servers. To rotate the key with zero downtime:
Update your backend service to accept both the old and new keys simultaneously.
Update the backend key in your gateway instance.
Remove support for the old key from your backend service.
How do I open an API to a specific user?
Configure access permissions for the API in the API Gateway console to control which users or applications can call it.