API access

What it is

API access is the set of controls that decide whether a client may call an API and what it may do after the call arrives. A secure design separates authentication (who or what is calling), authorization (what that caller may do), and traffic protections such as rate limits.

Why it exists

An API exposes business capability and often sensitive data. Northwind must know whether a request comes from its delivery partner, whether that partner may view the requested order, and whether a faulty client is sending too many requests. One shared secret or one gateway setting rarely answers all three questions safely.

Key ideas

• An API key or API Management subscription key is a secret used to grant access at the configured API or product scope. It can identify or meter a consumer, but it is not a human or application identity with fine-grained business authorization.
• A token, such as one issued by Microsoft Entra ID, can authenticate a caller and carry identity-related claims. The API or gateway must validate it correctly for its issuer, audience, expiry, and required permissions.
• API Management can check credentials and apply gateway rules. The backend should still authorize access to its own business data and operations.
• Azure RBAC controls management access to Azure resources. It is different from authorizing a customer to view one order through Northwind’s business API.

Northwind example

Northwind’s delivery partner calls GET /orders/1042/status. API Management validates the partner’s token and rate-limits requests. The orders backend then checks that this partner is assigned to order 1042 before returning status. If the partner uses a valid token for a different order, gateway authentication alone is not enough; the backend’s business authorization must reject it.

Common confusion

• Authentication says “this is the partner.” Authorization says “this partner may read this order.”
• An API key is not a substitute for a user password, a managed identity, or a full authorization model.
• Rate limiting protects capacity; it does not determine whether a caller is entitled to data.
• Never put API keys or tokens in source code, browser-delivered client secrets, or unprotected logs. Rotate and revoke exposed credentials.

Related

api-management · api-policies · rbac · managed-identity · service-principal · northwind-traders-case-study

Sources and re-audit

• Microsoft Learn — Azure API Management authentication and authorization and subscriptions, checked 2026-09-17.