Challenges in Managing Client Secrets for High-Scale API Integrations in Azure API Management

Mithila Lishan 71 Reputation points
2024-11-04T20:55:35.15+00:00

Currently, we are using an open-source API management application to manage APIs. This product primarily consists of two components: the Publisher, which is used to publish APIs, and the Store, which allows applications to subscribe to APIs. Once an application subscribes, the generated client ID and secret remain valid until the application is deleted.

However, when comparing this setup to Azure API Management, I observed some limitations in implementing these mechanism. In Azure API Management, after creating a client application, the secret generated has a maximum validity of 2 years under the custom date range option. After this period, new secrets need to be generated and distributed to all customers. Is this practical when dealing with API integrations involving a high number of customers?

Azure API Management
Azure API Management
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
2,166 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,055 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Khadeer Ali 570 Reputation points Microsoft Vendor
    2024-11-05T07:57:48.23+00:00

    Hi @Mithila Lishan,

    Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

    Managing client secrets for high-scale API integrations in Azure API Management (APIM) can indeed present some challenges, especially when compared to open-source solutions where secrets can remain valid indefinitely.

    To mitigate that challenge we can implement automated workflows using Azure Key Vault and Azure Functions to handle secret rotation.

    Please refer the below link for the documentation on the same.

    https://video2.skills-academy.com/en-us/azure/api-management/api-management-howto-mutual-certificates-for-clients

    If you find this answer helpful, please click "Accept Answer" and kindly upvote it.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.