We have developed a API proxy where response is a JWT Token (payload is passed in JWT). Currently it is encrypted with a key saved in KVM.
For the caller to decrypt the token we have to share the Key with them (which they will use in the end and will never transfer over network)
But it still has issue as the someone might get the key from caller's code or the caller gives it to someone.
How to have different Key for APIGEE & the caller and still do the data exchange (Like done in Diffie Helman Algorithm) where both sides have different private key?
LinkedIn
Twitter
