Securing the API

When publishing APIs via API Management, access to these APIs is secured by using subscription keys. Developers must include a valid subscription key in HTTP requests when calling an API; otherwise, these calls will be rejected by the API Management gateway. However, the transmission to the backend is not ensured.

If a developer wants to consume published APIs, a subscription is required. Developers who want to consume the published APIs must include a valid subscription key in HTTP requests when calling those APIs. But the calls can be rejected immediately by the API Management gateway or will not be forwarded to the backend services without a valid subscription key. They can get a subscription without approval from API publishers, although API publishers can even create subscriptions directly for API consumers.

Several API access security mechanisms are supported for Azure API Management Service, such as OAuth 2.0, client certificates, and IP allow lists.

...