Protect an API in Azure API Management using OAuth - Step-by-Step Tutorial

This comprehensive step-by-step tutorial demonstrates how to protect your APIs in Azure API Management using OAuth. OAuth is an open standard for authorization that enables secure access to your APIs without sharing user credentials. By integrating OAuth with Azure API Management, you can ensure that your API is accessible only to authorized users and applications.

📌 Timestamps:
00:00 - Introduction and Context
01:14 - OAuth Flow and Demo outline
01:51 - Demo

Come and say Hi!

Don't forget to like, share, and subscribe to stay up to date with the latest Azure and .NET tutorials!

#AzureAPIManagement #OAuth #APIsecurity

[merovingian]

Perfect! Loved the fact this this has clear explanation of what is being registered in AD and why. Thanks! helped me in setting up APIM.

[KrisMeister]

This was quick but good. I have used Oauth plenty as a developer, but have never setup it up with Azure.

[satyakarri]

Great video. Thanks for spending time to put it together.

[dheeraj]

short and sweet demo with precise steps. Thank you :)

[stergiazotali]

Sweet and short! It helped me resolved my task!!

[samithafernando]

Is there a way to use another identity provider such as Okta or Auth0 and perform OIDC flow?

[renanpinheiro]

Thank you very much for your video, but I had a question: If I have more than one customer wanting to use my api, do I always need to create a new app for them to access? If so, how do I dynamically add a new scope in APIM policies?

[kotisadhu]

Hi Sri, Can we apply SharePoint permissions to the azure app and authenticate the SharePoint api?

[lfesozl]

I am unable to add my APIs which one is hosted on AKS, how can I add

[gbvivol]

Great video! I want to secure powerautomate when a http request is recieved flow through api management could you please do a video on this as its not available in the entire internet.

[adityakalburgi]

I am getting security recommendation as API endpoints in azure api management should be authenticated. I have openai as backend & I dont want to use Azure AD. How should I resolve this issue using other self service setup other than Azure AD. Can you please guide me on this?

[mediocre.climber]

Given that I know the url to the backend function, what stops me from calling it directly?

[qchbude]

Hi @Sri Gunnala, thanks for the video. I have one doubt. If we can authentication in function app itself, then why do we need to configure Api management service?

[amiitdas]

@Sri Gunnala- Hi Sri Gunnala, I am able to generate the access token by configuring this and also added the jwt-validation policy in inbound request of the api to protect it. The problem is even though I have added the aut token as bearer, it shows invalid auth token error. Do I need to make any configuration related settings in apim itself for open-id connect

[dhanasekarapandiansrinivas]

Interesting.. is it possible to protect only few endpoints which path starts with some prefix? for example
lets say /public/* are unprotected and /protected/api/* are all protected

[ashokm]

I don't want to supply client secret in client scripts ... we have thousands of devices call APIs through APIM. I don't want share client secret in devices