Agent API consumer authentication verifies caller identity using API keys or JWTs, enabling fine-grained per-tenant access control, sensitive data isolation, and protection against unauthorized access and resource abuse.
Policy
Security:
Consumer authentication blocks unauthorized users and systems from accessing sensitive resources by verifying their identity, for example, with an API key.
This authentication helps prevent malicious activities such as web scraping, API abuse, and DDoS attacks.
In a multitenancy system, consumer authentication lets you assign independent access permissions to different tenants, ensuring each tenant can only access their own data.
You can combine consumer authentication with a throttling policy to configure rules for each consumer based on Token consumption, keeping usage within the allocated quota.
Use cases
Multitenant systems: Assign unique API access permissions to different tenants on an open platform to ensure data isolation and security.
Open platforms: Provide controlled API access to third-party developers to ensure platform security and stability.
Ensure only authorized services can call specific AI interfaces within a microservices architecture.
Paid service management: Control access to premium features or large models based on a user's subscription level or permissions.
Procedure
After you enable consumer authentication, you can configure throttling rules based on token usage for each consumer. Throttling is automatically triggered when the preset usage limit is exceeded.
-
Log on to the AI Gateway console, and select the region where your instance is located.
-
Go to the target instance page. In the left-side navigation pane, choose Agent API.
-
Select the Consumer certification tab. To the right of Configuration Information, click Edit and configure the following parameters:
ImportantAfter consumer authentication is enabled, only authorized consumers can access the API.
Status: Enable or disable consumer authentication. It is disabled by default.
Authentication Method: The supported authentication methods are API Key and JWT.
-
API Key: When a client makes a request, it must include the API key. The gateway then validates the key and its associated permissions.
-
JSON Web Token (JWT): A standard used to securely transmit information between a client and a server as a JSON object. This information is verifiable and trustworthy because it is digitally signed using an algorithm such as HMAC, RSA, or ECDSA. The gateway can use a JWT to validate a caller's identity and control access.
-
-
In the Consumers section, click Authorization and select a consumer. If no consumer exists, click Create Consumer to create one. Then, click Add.