Cloud Blog

All posts by Amila Mahaarachchi

Configure the header to carry the Bearer token

APIs published on the WSO2 API Cloud are secured using OAuth2.0 by default. Any client application invoking a secure published API needs to have a valid subscription to the particular API and present a valid OAuth2.0 Access Token to the API Gateway.

The HTTP Authorization header is the most common method of providing authentication information for REST APIs and it is used in API Cloud as well. The application needs to have the access token in the Authorization header to authenticate the API that is being accessed. But, there can be reasons such as organizational policies, legacy backends expecting to use the authorization header for other purposes and legacy client applications which will force you to use some other header to pass the bearer token to the API gateway.

WSO2 API Cloud now allows you to define your own header to carry the bearer token. This can be configured for the entire organization (all your APIs) or for certain APIs only.

Configure the authorization header per API

When creating a new API or editing an existing API,

  1. Go to the “Manage” tab in the UI.
  2. Provide the name of the header which you wish to use as the authorization header as shown below. 
     
  3. Save and publish the API.
  4. When you go to the developer portal, you will be able to see the portal is ready to send the new header to the gateway.
  5. If you want to invoke the API with cURL, following is the command

curl  -X GET “<Your API URL>” -H “Accept: application/json” -H “Token: Bearer <Your Token>”

Read our documentation to learn how to configure this at the organization level.

Now that this cool feature is available in the WSO2 API Cloud, you will be able to connect your legacy backends and legacy clients to the API gateway without worrying about the authorization header.

How to avoid your backend endpoint getting suspended by the API Gateway

When invoking an API published in API Cloud, you might have seen the following error response:

<am:fault xmlns:am="http://wso2.org/apimanager"><am:code>303001</am:code><am:type>Status report</am:type><am:message>Runtime Error</am:message><am:description>Currently , Address endpoint : [ Name : somename-AT-sometenant--test_me_APIproductionEndpoint_0 ] [ State : SUSPENDED ]</am:description></am:fault>

As you can see from the message above, the endpoint got suspended. By default, gateway suspends API for 30 seconds when it cannot reach the endpoint. So, if another request comes to your API within that 30 seconds, it won’t be sent to the backend, rather an error response similar to above will be sent back to the client.

If this is not the behavior you want, these rules are simple to modify:

1. Go to API Publisher and select the API that you want to change. Then click Edit from API Overview

2. Under the Implement tab, select Advanced Options on the endpoint which you want to re-configure.

step1

3. Modify the values. If you want to disable the suspension rules, set both Initial Duration and Max Duration to 0:

step2

4. Save changes and re-publish the API.

This way you can tweak the suspension rules or completely disable the mechanism and thus prevent your API from ever getting suspended by the API gateway.

Try it today in WSO2 API Cloud!

Categories

Recent Posts

Most Popular Posts