This topic describes the authentication methods, network environments, and app authorization options available when calling APIs published in API Gateway.
Authentication methods
API Gateway supports four authentication methods. Choose based on your security requirements and deployment environment.
|
Method |
How it works |
Security level |
Best for |
|
No authentication |
Clients call APIs without credentials. |
Lowest — not recommended for production |
Temporary tests only |
|
AppCode |
Clients include a valid AppCode in the request header or as a query parameter. API Gateway validates it. |
Low |
Internal network calls between systems |
|
Digest authentication |
Clients use an AppKey and AppSecret to sign the request content. API Gateway verifies the key pair and signature. |
High |
Most production scenarios |
|
JSON Web Token (JWT) |
Clients authenticate using a JWT plug-in. |
Highest |
JavaScript and web frontend apps where client-side signing is a security risk |
Digest authentication is the recommended approach for most API calls. It provides strong security and broad SDK support — API Gateway SDKs for multiple languages include the signing mechanism, so you don't need to implement it manually.
To use the SDK-based signing approach, see Use SDKs to call APIs.
To implement request signing yourself, see Request signature.
For AppCode-based authentication, see Call an API operation by using an AppCode.
For JWT-based authentication, see JWT authentication plug-in.
Network environments
Clients can call APIs over the Internet or over a Virtual Private Cloud (VPC).
For Internet calls, use one of the authentication methods described above.
For VPC calls, see:
App authorization
When an API uses Alibaba Cloud APP authentication, you must authorize an app before it can call that API.
An app is the identity used to call APIs. Each app has an AppKey and AppSecret key pair. When making a call, the app includes the AppKey in the request header and uses the AppSecret to generate a signature.
You can authorize apps you own, or authorize apps that belong to other users by specifying their app IDs.
For details, see Authorize an application to call an API operation.