Accept API Key & JWT Auth on the Same Route | Zuplo API Gateway

Most APIs need to authenticate two kinds of clients: real users hitting a dashboard, and services calling programmatically. The users carry JWTs from your identity provider. The services carry API keys.

In this video I show you how to handle both on the same Zuplo route, using only built-in policies and a three-line enforcement check. No custom auth code, no shared secrets, no compromise on security.

00:00 The dual-auth problem
00:40 Demo: one route, two credential types
01:55 Setting up the policies
02:50 Combining them with a composite policy
03:25 Allowing both auth types through the chain
04:35 Configuring the JWT policy with Auth0
05:15 Adding the composite to the route
05:50 Hardening with a require-auth check
06:55 Wiring up the custom code policy
07:35 Testing both credential types
08:30 Wrap up

Resources:
- Multi-auth pattern docs: https://zuplo.com/docs/articles/multiple-auth-policies
- API Key Authentication policy: https://zuplo.com/docs/policies/api-key-inbound
- OpenID JWT Auth policy: https://zuplo.com/docs/policies/open-id-jwt-auth-inbound

Try Zuplo free: https://zuplo.link/check-us-out

Видео Accept API Key & JWT Auth on the Same Route | Zuplo API Gateway канала Zuplo