Executive Summary

For token generation and verification in Google Apigee (X/Hybrid/Edge), the recommended standard is to use the OAuthV2 Policy or VerifyJWT Policy attached to the PreFlow or Request Flow of your API proxy.

Implementation Guide

1. OAuthV2 Policy (Verify Access Token)

Attach the following OAuthV2 policy in your proxy Request flow before reaching the Target Endpoint:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<OAuthV2 async="false" continueOnError="false" enabled="true" name="OAuth-VerifyAccessToken">
    <DisplayName>OAuth-VerifyAccessToken</DisplayName>
    <Operation>VerifyAccessToken</Operation>
    <Scope>read write</Scope>
    <GenerateResponse enabled="true"/>
</OAuthV2>

2. VerifyJWT Policy (For Signed OAuth2 OpenID / Microservices)

If validating RFC 7519 JSON Web Tokens issued by Google Cloud Identity or Auth0:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyJWT async="false" continueOnError="false" enabled="true" name="JWT-VerifyToken">
    <DisplayName>JWT-VerifyToken</DisplayName>
    <Algorithm>RS256</Algorithm>
    <PublicKey>
        <JWKS ref="jwt_jwks_uri"/>
    </PublicKey>
    <Issuer>https://auth.example.com/</Issuer>
    <Audience>https://api.apigeecommunity.com</Audience>
</VerifyJWT>

Security & Architectural Best Practices

• Flow Hooks: For enterprise-wide OAuth enforcement across all proxies, deploy this logic inside a Pre-Proxy Flow Hook bound to your Environment.
• Fault Rules: Add a FaultRule matching fault.name = "invalid_access_token" to return a standardized RFC 7807 problem details JSON payload (401 Unauthorized).
• Encrypted KVMs: Store Client Secrets and JWKS endpoints in encrypted Key-Value Maps rather than hardcoding in policy XMLs.

📖 Reference: Google Cloud Apigee OAuthV2 Policy Documentation
Hope this helps! Feel free to ask a follow-up if you need an end-to-end trace debugging walkthrough.