Azure APIM Api - Secure with Oauth2 & Subscription Key ?

Question

Looking for a little guidance here about best practise.

When creating an api on an existing APIM instance I am securing it with OAuth2 using the "validate-jwt" policy.

Should we also be using the subscription id as part of this process or is OAuth2 enough?

I don't see what additional security a subscription key alongside OAuth2 provides. Are you able to provide any best practise feedback?

Answer 1

Hi Butcher, Daniel, I want to help you with your question.

In the enterprise environment, I would always go the route of additionally securing the Auth Flow with Subscription IDs, unless there are critical or design reasons not to do so.

OAuth 2 is already very robust in terms of security, but with the SubscriptionID I have another layer of protection and also get additional features in terms of monitoring and management, such as tracking API requests from different clients, enforcing rate limits, or simply withdrawing access

---

If the reply was helpful, please don’t forget to upvote or accept it as an answer, thank you!