Azure APIM Api - Secure with Oauth2 & Subscription Key ?

Question

Looking for a little guidance here about best practise.

When creating an api on an existing APIM instance I am securing it with OAuth2 using the "validate-jwt" policy.

Should we also be using the subscription id as part of this process or is OAuth2 enough?

I don't see what additional security a subscription key alongside OAuth2 provides. Are you able to provide any best practise feedback?

Answer 1

Hi Butcher, Daniel, I want to help you with your question.

In the enterprise environment, I would always go the route of additionally securing the Auth Flow with Subscription IDs, unless there are critical or design reasons not to do so.

OAuth 2 is already very robust in terms of security, but with the SubscriptionID I have another layer of protection and also get additional features in terms of monitoring and management, such as tracking API requests from different clients, enforcing rate limits, or simply withdrawing access

---

If the reply was helpful, please don’t forget to upvote or accept it as an answer, thank you!

Answer 2

Thanks for the response - from what I understand the subscription id is just a basic form of auth and doesn't really provide any additional level of security that we don't already achieve from OAuth.

Outside of the benefits of monitoring I can't really see the point. You could achieve withdrawing access by removing the secret from the app reg.