Securing Apigee APIs with OAuth 2.0 and Mutual TLS (mTLS)

Zero Trust Security with Apigee

Modern enterprise API gateways require robust multi-layered security. Combining Transport Layer Security with Mutual Authentication (mTLS) and OAuth 2.0 Bearer tokens ensures that both client hardware identities and client application contexts are verified.

Implementing OAuth 2.0 Access Token Verification

In Apigee, the OAuthV2 policy allows you to generate, verify, and refresh OAuth tokens easily:

<OAuthV2 name="Verify-OAuth-v20">
    <Operation>VerifyAccessToken</Operation>
    <GenerateResponse enabled="true"/>
</OAuthV2>

Key Considerations for mTLS Setup

• Client Keystores & Truststores: Store trusted CA certificates in Apigee Environment Truststores.
• Client Certificate Extraction: Access client certificate details in flow variables such as tls.client.s.dn and tls.client.client.raw.cert.
• JWT Verification: Validate JSON Web Tokens (JWT) signed by external Identity Providers (IdPs) like Okta, Auth0, or PingIdentity using the VerifyJWT policy.