You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: How to configure access to APIs in the Azure API Center inventory using API keys or OAuth authorization.
2
+
title: Configure API access in Azure API Center
3
+
description: Learn how to configure access to APIs in the Azure API Center inventory using API keys or OAuth 2.0 authorization. Users authorized for access can test APIs in the API Center portal.
4
4
author: dlepow
5
5
ms.service: azure-api-center
6
6
ms.topic: how-to
7
7
ms.date: 04/23/2025
8
8
ms.author: danlep
9
9
ms.custom:
10
-
# Customer intent: As an API program manager, I want to ... TBD t
10
+
# Customer intent: As an API program manager, I want to ... TBD
11
11
---
12
12
13
-
# Authorize access to APIs in your API Center
14
-
15
-
> [!NOTE]
16
-
> This feature is currently in preview.
17
-
18
-
## Scenario overvivew
13
+
# Authorize access to APIs in your API Center inventory
19
14
15
+
<!-- Is this a governance or inventory feature -->
20
16
21
-
<!-- Check if these prereqs are sufficient/necessary -->
You can configure settings to authorize users to access APIs in your API center inventory.
23
18
24
-
* To test APIs, enable the [API Center portal](set-up-api-center-portal.md) in your API center.
19
+
* Add settings to the API center for authentication using API keys or OAuth 2.0 authorization.
20
+
* Associate specific authentication settings with specific API versions in your inventory.
21
+
* Restrict use of API authentication methods to designated users or groups using access policies.
22
+
* Enable authorized users to test APIs directly in the API Center portal.
25
23
26
-
* Register a test API in your API center. For more information, see [Tutorial: Register APIs in your API inventory](register-apis.md).
27
-
28
-
* Configure an environment and a deployment for the API. For more information, see [Tutorial: dConfigure environments and deployments](configure-environments-deployments.md).
24
+
> [!NOTE]
25
+
> This feature is currently in preview.
29
26
30
-
## Configure authorization
27
+
* An API center in your Azure subscription. If you haven't created one already, see [Quickstart: Create your API center](../set-up-api-center.md).
31
28
32
-
Configure an authorization in your API center. API users or client apps can use this authorization to authenticate requests to the API.
29
+
* Register at least API in your API center. For more information, see [Tutorial: Register APIs in your API inventory](register-apis.md).
33
30
34
-
*An authorization can either be an API key or an OAuth 2.0 authorization code flow.
31
+
*Configure an environment and a deployment for the API. For more information, see [Tutorial: Add environments and deployments for APIs](configure-environments-deployments.md).
35
32
36
-
*You can associate the authorization with one or more APIs or API versions.
33
+
*Set up the API Center portal. For more information, see [Set up API Center portal](set-up-api-center-portal.md).
37
34
38
-
*The authorization can be used in the API Center portal to test the API.
35
+
*(To configure settings for OAuth 2.0 authorization using Microsoft Entra ID) Permissions to create an app registration in a Microsoft Entra tenant associated with your Azure subscription.
39
36
40
37
38
+
## Configure settings for API key authentication
41
39
42
-
### API key authorization
40
+
Follow these steps to configure settings for API key authentication. The API key is stored in Azure Key Vault, and the API center uses a managed identity to access the key vault.
43
41
44
-
####Store secret in Azure Key Vault
42
+
### Store secret in Azure Key Vault
45
43
46
44
To store the API key securely, use Azure Key Vault. You can create a new key vault or use an existing one, using the Azure portal, Azure tools, or Azure SDKs. Your key vault should use the Azure role-based access control (RBAC) permission model.
47
45
48
46
* For steps to create a Key Vault, see [Create a Key Vault](/azure/key-vault/general/quick-create-portal).
49
47
50
48
* To store a secret in the Key Vault, see [Set and retrieve secret in Key Vault](/azure/key-vault/secrets/quick-create-portal).
51
49
52
-
Note the *secret identifier* of the secret. This is a URI of the form `https://<key-vault-name>.vault.azure.net/secrets/<secret-name>` (without version information). You will need this value when you configure the API key authorization in your API center.
50
+
Note the *secret identifier* of the secret. This is a URI of the form `https://<key-vault-name>.vault.azure.net/secrets/<secret-name>/<version>`. You will need this value when you configure the API key authorization in your API center.
53
51
54
52
<!-- Should we use the version of the secret in the URI? -->
55
53
56
54
57
-
####Enable a managed identity in your API center
55
+
### Enable a managed identity in your API center
58
56
59
57
For this scenario, your API center uses a [managed identity](/entra/identity/managed-identities-azure-resources/overview) to access Azure resources. Depending on your needs, enable either a system-assigned or one or more user-assigned managed identities.
60
58
@@ -66,9 +64,9 @@ The following examples show how to enable a system-assigned managed identity by
66
64
1. Select **System assigned**, and set the status to **On**.
67
65
1. Select **Save**.
68
66
69
-
####Assign the Key Vault Secrets User role to the managed identity
67
+
### Assign the Key Vault Secrets User role to the managed identity
70
68
71
-
Assign your API center's managed identity the **Key Vault Secrets User** role in your key vault. The following steps use the [portal](../../role-based-access-control/role-assignments-portal-managed-identity.yml).
69
+
Assign your API center's managed identity the **Key Vault Secrets User** role in your key vault. The following steps use the [portal](../role-based-access-control/role-assignments-portal-managed-identity.yml).
72
70
73
71
1. In the [portal](https://azure.microsoft.com), navigate to your key vault.
74
72
1. In the left menu, select **Access control (IAM)**.
@@ -80,7 +78,7 @@ Assign your API center's managed identity the **Key Vault Secrets User** role in
80
78
1. Select **Review + assign**.
81
79
82
80
83
-
#### Configure API key authorization in portal
81
+
###Add API key configuration in your API center
84
82
85
83
1. In the [portal](https://azure.microsoft.com), navigate to your key API center.
86
84
1. In the left menu, under **Assets**, select **Authorization (preview)** > **+ Add configuration**.
@@ -89,58 +87,114 @@ Assign your API center's managed identity the **Key Vault Secrets User** role in
89
87
1. In **Security scheme**, select **API Key**.
90
88
1. In **API key location**, select how the key is presented in API requests. Available values are **Header** (request header) and **Query** (query parameter).
91
89
1. In **API key parameter name**, enter the name of the HTTP header or query parameter that contains the API key. For example, `x-api-key`.
92
-
1. In **API key Key Vault secret reference**, enter the URI of the secret in your key vault that contains the API key. This is a URI of the form `https://<key-vault-name>.vault.azure.net/secrets/<secret-name>.
93
-
1. In **Key vault secret**, enter the URI of the secret in your key vault that contains the API key. This is a URI of the form `https://<key-vault-name>.vault.azure.net/secrets/<secret-name>`.
90
+
1. In **API key Key Vault secret reference**, enter the URI of the secret in your key vault that contains the API key. This is a URI of the form `https://<key-vault-name>.vault.azure.net/secrets/<secret-name>/<version>`.
94
91
1. Select **Create**.
95
92
96
93
97
-
### OAuth 2.0 authorization
94
+
## Configure settings for OAuth 2.0 authorization
95
+
96
+
<!-- Which identity providers are supported? Just Entra? -->
97
+
98
+
99
+
You can configure one or both of the following OAuth 2.0 authorization flows:
100
+
101
+
* Authorization code flow with PKCE (Proof Key for Code Exchange) - This flow is recommended for public clients, such as mobile apps or single-page applications (SPAs).
102
+
* Client credentials flow - This flow is recommended for confidential clients, such as web apps or web APIs.
103
+
104
+
105
+
### Create an OAuth 2.0 app
98
106
107
+
For OAuth 2.0 authorization, create an app registration in an identity provider, such as the Microsoft Entra tenant associated with your Azure subscription. This app registration is used to authenticate users and authorize access to your APIs. The exact steps depend on the identity provider you use. The following example shows how to create an app registration in the Microsoft Entra tenant associated with your Azure subscription.
99
108
100
-
#### Create an OAuth 2.0 app
101
109
102
110
111
+
Minimally you need to configure:
103
112
113
+
* A client secret for the app registration.
114
+
* Any required scopes for the API.
115
+
* A redirect URI for the app registration, when using the authorization code flow.
104
116
105
-
#### Configure authorization in portal
106
117
107
-
TBD
118
+
1. Sign in to the [Azure portal](https://portal.azure.com) with an account with sufficient permissions in the tenant.
119
+
1. Navigate to **Microsoft Entra ID** > **+ New registration**.
120
+
1. On the **Register an application** page, enter your application registration settings:
121
+
1. In **Name**, enter a meaningful name for the app.
122
+
1. In **Supported account types**, select an option that suits your scenario, for example, **Accounts in this organizational directory only (Single tenant)**.
123
+
1. Set the **Redirect URI** to **SPA**, and set the URI. Enter the URI of your API Center portal deployment, in the following form: https://<service-name>.portal.<location>.azure-api-center.ms.
124
+
1. Select **Register**.
125
+
1. On the left menu, under **Manage**, select **Certificates & secrets**, and then select **+ New client secret**.
126
+
1. Enter a **Description**.
127
+
1. Select an option for **Expires**.
128
+
1. Select **Add**.
129
+
1. Copy the client secret's **Value** before leaving the page. You will need it in the following section.
108
130
131
+
In the following section, you will need the following values:
109
132
133
+
* The **Application (client) ID** and **Directory (tenant) ID** values from the app registration's **Overview** page.
134
+
* The following endpoints on the app registration's **Overview** > **Endpoints** page:
135
+
***OAuth2.0 authorization endpoint (v2)** - the authorization endpoint for Microsoft Entra ID
136
+
***OAuth 2.0tToken endpoint** - the token URL for Microsoft Entra ID.
110
137
111
-
##Associate authorization with API
138
+
### Add OAuth 2.0 authorization in your API center
112
139
113
-
You associate an authorization with an API version.
140
+
1. In the [portal](https://azure.microsoft.com), navigate to your key API center.
141
+
1. In the left menu, under **Assets**, select **Authorization (preview)** > **+ Add configuration**.
142
+
1. In the **Add authorization** page, set the values as follows:
143
+
1. Enter a **Title** (name) and optional **Description** for the authorization.
144
+
1. In **Security scheme**, select **OAuth2**.
145
+
1. In **Client ID**, enter the client ID of the app that you created in the previous section.
146
+
1. In **Client secret**, enter the client secret of the app that you created in the previous section.
147
+
1. In **Authorization URL**, enter the OAuth 2.0 authorization endpoint configured in the app in the previous section.
148
+
1. In **Token URL**, enter the OAuth 2.0 token endpoint configured in the app in the previous section.
149
+
1. In **OAuth2 flow**, select one or both of the OAuth 2.0 flows that you want to use. Available values are **Authorization code (PKCE)** and **Client credentials**.
150
+
1. In **Scopes**, optionally enter one or more API scopes that your API supports. Example: `User.Read`
151
+
1. Select **Create**.
152
+
153
+
## Add authentication settings to an API version
154
+
155
+
After configuring settings for an API key or an OAuth 2.0 flow, add the API key or OAuth 2.0 authentication to an API versions in your inventory.
114
156
115
157
1. In the [portal](https://azure.microsoft.com), navigate to your key API center.
116
158
1. In the left menu, under **Assets**, select **APIs**.
117
159
1. Select an API that you want to associate the authorization with.
118
160
1. In the left menu, under **Details**, select **Versions**.
119
-
1. Select the API version that you want to associate the authorization with.
161
+
1. Select the API version that you want to add the authentication settings to.
120
162
1. In the left menu, under **Details**, select **Manage Access (preview)** > **+ Add authentication**.
121
163
1. In the **Add authentication** page, select an available **Authentication configuration** that you want to associate with the API version.
122
164
1. Select **Create**.
123
165
166
+
> [!NOTE]
167
+
> You can add multiple authentication settings to an API version. For example, you can add both API key and OAuth 2.0 authentication settings to the same API version. Similarly, you can add the same authentication settings to multiple API versions.
124
168
125
-
## Test API with authorization in API Center portal
126
-
You can test an API with the authorization in the API Center portal.
127
-
<!--
128
-
### API visibility
169
+
## Limit access to specific users or groups
170
+
171
+
You can limit access to the authentication settings associated with an API to specific users or groups in your organization. You do this by configuring an access policy that assigns users or groups the **API Center Credential Access Reader** role, scoped to specific authentication settings in the API. This is useful if you want to allow only specific users to test an API in the API Center portal.
129
172
130
-
API visibility settings control which APIs are discoverable (visible) to API Center portal users. The API Center portal uses the data plane API to retrieve and display APIs, and by default retrieves all APIs in your API center.
131
173
132
-
To make only specific APIs visible, go to the **API visibility** tab in the API Center portal settings. Here, add filter conditions for APIs based on built-in or custom API [metadata](metadata.md) properties. For instance, you can choose to display APIs only of certain types (like REST or GraphQL) or based on certain specification formats (such as OpenAPI). Additionally, you can select values of custom metadata properties that categorize your APIs.
174
+
1. In the [portal](https://azure.microsoft.com), navigate to your key API center.
175
+
1. Navigate to an API version to which you've added authentication settings (see previous section).
176
+
1. In the left menu, under **Details**, select **Manage Access (preview)**.
177
+
1. Select the **Edit access policies** dropdown at the end of the row for the authentication settings you want to limit access to.
178
+
1. In the **Manage access** page, select **+ Add > Users** or **+ Add > Groups**.
179
+
1. Search for and select the users (or groups) that you want to add. You can select multiple items.
180
+
1. Click **Select**.
133
181
134
-
:::image type="content" source="media/set-up-api-center-portal/add-visibility-condition.png" alt-text="Screenshot of adding API visibility conditions in the portal.":::
182
+
> [!TIP]
183
+
> You can also remove users or groups from the access policy. In the **Manage access** page, select **Delete** in the context (...) menu for the user or group.
135
184
136
-
## Enable sign-in to portal by Microsoft Entra users and groups
0 commit comments