API / APIGEE Gateway Interview Questions
How does OAuth 2.0 work in Apigee and what grant types are supported?
Apigee implements the complete OAuth 2.0 specification via the OAuthV2 policy. Apigee can act as an authorisation server (issuing tokens) or as a resource server (validating tokens), or both. All four OAuth 2.0 grant types are supported.
| Grant type | Use case | Flow summary |
|---|---|---|
| client_credentials | Machine-to-machine; no user involved | App sends client_id + client_secret; Apigee returns access token |
| password (Resource Owner Password) | Trusted first-party apps | User sends username + password; Apigee validates + returns token |
| authorization_code | Third-party apps; user consent required | Redirect flow; user authenticates at IdP; code exchanged for token |
| implicit | Single-page apps (legacy; less secure) | Token returned directly in URL fragment; no backend code exchange |
<!-- Step 1: GenerateAccessToken policy (Apigee acts as auth server) --> <OAuthV2 name="GenerateToken"> <Operation>GenerateAccessToken</Operation> <ExpiresIn>3600000</ExpiresIn> <!-- 1 hour in milliseconds --> <SupportedGrantTypes> <GrantType>client_credentials</GrantType> </SupportedGrantTypes> <GenerateResponse enabled="true"/> </OAuthV2> <!-- Step 2: VerifyAccessToken policy (protect API proxies) --> <OAuthV2 name="VerifyToken"> <Operation>VerifyAccessToken</Operation> </OAuthV2> <!-- Client credentials token request: POST /oauth/token Authorization: Basic base64(client_id:client_secret) Content-Type: application/x-www-form-urlencoded grant_type=client_credentials Response: { "access_token": "eyJ...", "token_type": "BearerToken", "expires_in": "3599" } -->
When acting as a resource server only (validating tokens issued by an external IdP), Apigee validates the token's signature and expiry using the VerifyAccessToken operation, optionally checking scopes and audience claims.
Which OAuth 2.0 grant type is most appropriate for server-to-server API access where no human user is involved?
What is the difference between Apigee acting as an 'authorisation server' vs a 'resource server' in OAuth 2.0?
More Related questions...
