Query on API Management: Obtaining Subscription Keys Outside Developer Portal, Easy Auth, and Comparison with B2C Tokens

Question

Query on API Management: Obtaining Subscription Keys Outside Developer Portal, Easy Auth, and Comparison with B2C Tokens

hampton123 1,175

I was wondering if API management subscription keys can be received through methods outside of the developer portal, such as Postman. I have Easy Auth for my Azure Functions in APIM as well as the subscription key protecting them. I was just curious if in the same way that B2C tokens can be obtained, subscription keys can be obtained.

Accepted answer

0 additional answers

Your answer

Answer 1

MuthuKumaranMurugaachari-MSFT 22,441 Moderator

hampton123 Thanks for posting your question in Microsoft Q&A. Yes, you can retrieve subscription keys (Primary/Secondary) for Subscriptions via Subscription - List Secrets rest API from any client including Postman. sid - subscription entity identifier needs to be passed and this can be retrieved via Subscription - List API.

To call this API, appropriate role permission such as Microsoft.ApiManagement/service/subscriptions/listSecrets/action should be assigned for user/application and check out https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftapimanagement for more info about the list of permissions.

User's image

I hope this helps and let me know if any questions.

If you found the answer to your question helpful, please take a moment to mark it as Yes for others to benefit from your experience. Or simply add a comment tagging me and would be happy to answer your questions.

hampton123 1,175 Reputation points

2024-01-18T18:15:08.6766667+00:00
Hi Muthu! Hope you're having a good day. I've been trying to get the sid value, however each time in Postman I get errors. Without an authorization header, I get the code AuthenticationFailed, with the error message below:

Authentication failed. The 'Authorization' header is missing.

When I use a token associated with the API Management service that uses B2C, however, I obtain the code InvalidAuthenticationTokenTenant. The error message appears like this:

The access token is from the wrong issuer 'https://{b2c-tenant}.b2clogin.com/{app-regisration}/v2.0/'. It must match one of the tenants '{tenant-1},{tenant-2}' associated with this subscription. Please use any authority (URL) from '{auth-url-1},{auth-url-2}' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.

I'm using a B2C token because I want outside users to be able to access their subscription keys associated with their accounts. It is not in the same tenant, however. I tried navigating to the auth-urls in the error message, however I obtain a 404 Not Found status. What do you think I should do to fix this issue? Thank you in advance.
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2024-01-18T18:55:34.19+00:00

The access token should be generated for the same tenant as APIM instance in Azure AD and see similar discussion related to this. The token generated for B2C tenant cannot be used.
hampton123 1,175 Reputation points

2024-01-18T18:59:32.62+00:00

Hi Muthu, thank you for your response. Would there be any method for users within the separate B2C tenant to gain access to their subscription keys other than through the developer portal? Or is it required that the users be in the same tenant?
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2024-01-18T19:20:11.92+00:00

Yes, and B2C user cannot access it.
hampton123 1,175 Reputation points

2024-01-18T19:41:35.0033333+00:00

Thank you for your assistance Muthu!

Share via

Query on API Management: Obtaining Subscription Keys Outside Developer Portal, Easy Auth, and Comparison with B2C Tokens

0 additional answers

Your answer