Protect an API in Azure API Management using OAuth - Step-by-Step Tutorial

[@CyberJuke5]

I've never leaned how this works in practice, kudos for this nice vid!

[@KrisMeister]

This was quick but good. I have used Oauth plenty as a developer, but have never setup it up with Azure.

[@merovingian8853]

Perfect! Loved the fact this this has clear explanation of what is being registered in AD and why. Thanks! helped me in setting up APIM.

[@srigunnala]

I am glad you found it helpful! Cheers, Sri!

[@kendeanon3171]

Thank you it helped with my project!

[@srigunnala]

Glad it helped you!!

[@dheeraj0076]

short and sweet demo with precise steps. Thank you :)

[@srigunnala]

I am gland you liked it. Thanks, Sri!

[@bekkur81]

Simply amazing! You have helped so much on a tight deadline!

[@srigunnala]

I am glad it helped you!

[@stergiazotali2282]

Sweet and short! It helped me resolved my task!!

[@srigunnala]

Thank you!

[@smellbow]

Great video, really helped me understand the process and setup a simple demo api with oauth i can build upon.

[@bartleyrob]

very to the point thanks !

[@phenomenal325]

Can't you bypass a pim if you get the function app URL, what's protecting it at that level?

[@satyakarri9277]

Great video. Thanks for spending time to put it together.

[@DacarSoft]

Thanks, great video

[@srigunnala]

Thank you!

[@mannyb4265]

Very good guide. Thank you.

[@renanpinheiro1688]

Thank you very much for your video, but I had a question: If I have more than one customer wanting to use my api, do I always need to create a new app for them to access? If so, how do I dynamically add a new scope in APIM policies?

[@samithafernando6432]

Is there a way to use another identity provider such as Okta or Auth0 and perform OIDC flow?

[@amiitdas]

@Sri Gunnala- Hi Sri Gunnala, I am able to generate the access token by configuring this and also added the jwt-validation policy in inbound request of the api to protect it. The problem is even though I have added the aut token as bearer, it shows invalid auth token error. Do I need to make any configuration related settings in apim itself for open-id connect

[@kesavprakash9580]

same for me got any solution?

[@sumitsandhir5112]

Hi Please remove api:// from the scope while adding it inside name value section. Then try again, I hope it works.

[@huskyanimal3888]

@@sumitsandhir5112 Still doesn't work for me, any solution else ?

[@atulonweb1]

Thanks buddy... but what about refresh token, how that will be generated and validated

[@dhanasekarapandiansrinivas4542]

Interesting.. is it possible to protect only few endpoints which path starts with some prefix? for example lets say /public/* are unprotected and /protected/api/* are all protected

[@srigunnala]

Hello, Thanks for checking my video. You can simply separate them by product and apply policies at product-level

[@cloudbaud7794]

Can products then have hierarchy

[@dotnet8925]

quick and informative

[@SupreetaPoojary-s4d]

Hi @Sri Gunnala, thanks for the video. I have one doubt. If we can authentication in function app itself, then why do we need to configure Api management service?

[@MarkoVukovic0]

This is for authorization, not authentication.

[@Ashok_mukkara]

I don't want to supply client secret in client scripts ... we have thousands of devices call APIs through APIM. I don't want share client secret in devices

[@LaxmideviMule]

Great video! I want to secure powerautomate when a http request is recieved flow through api management could you please do a video on this as its not available in the entire internet.

[@kotisadhu8410]

Hi Sri, Can we apply SharePoint permissions to the azure app and authenticate the SharePoint api?

[@adityakalburgi1548]

I am getting security recommendation as API endpoints in azure api management should be authenticated. I have openai as backend & I dont want to use Azure AD. How should I resolve this issue using other self service setup other than Azure AD. Can you please guide me on this?

[@mediocre.climber]

Given that I know the url to the backend function, what stops me from calling it directly?

[@ianwanjala8621]

how does this work in the dev portal?