Support Subscription-key based authentication or OAUTH2 for APIM endpoint

Question

Hi,

I have an APIM hosted api endpoint. I have two different clients. One client should access this api with just a subscription-key. Other client should access this with OUTH2 JWT. How can I achieve this on the policy.

If I disable the subscription-key required flag for the policy, how to achieve the subscription-key based access.

Thanks,
Ujjwal

Answer 1

@ujjwalDev Even if a subscription isn't required, when passed it is still parsed. So, you could use the choose statement to decide based on the header set like below

   <choose>  
       <when condition="@(context.Subscription?.Name != null)">  
           <!-- Subscription ID was present -->  
       </when>  
       <when condition="@(!String.IsNullOrWhiteSpace(context.Request.Headers.GetValueOrDefault("Authorization", "")))">  
           <!-- Authorization Header was present -->  
       </when>  
       <otherwise>  
           <!-- Neither was present -->  
       </otherwise>  
   </choose>