Securely accessing a public api with a Q2 api

Question

My team is looking to securely connect to a company api that is exposed to the outside world from a Q2 api. What are the best practices around creating a secure connection? Would this simply be a matter of the Q2 api making an OAuth call to a company server to get a token? How have other projects handled authorization to a company resource?

Thanks in advance!

		
				0
				
Posted 
	4 years ago

					⠿More
				  		
			 Report
		
					Noah Krueger
				
					0

Jason Herbert · Answer

Hi Noah Really depends on how your company API is secured Since you mentioned OAuth the traditional mechanism for backend API to backend API is via client credentials auth workflow You generate client credentails like a client id and client secret within your identity provider store those values within the Q2 platform we use a secret management tool called vault https docs q2developer com guides performance and security vault html Then at request time the client id and client secret are exchanged with your API to get back a access token which is then used on subsequent reqeuests to your API Hope this helps Jason

Answers