We have a partner that wants to call an API on our side through a somewhat outdated system. We have asked them if the could modify their system to send a API Key.
Their answer was no. We don't want to leave our API unsecure as this API will save data in our sytem and we don't want to end up with fictitious data in our system.
We tried using the Access Control Policy but what I have found is that the client.ip or X-Forwarded-For is the same whether I hit our API from their website or if I
hit our API from within our network using postman. Is their something I am doing wrong? Does apigee need to configure something so we see the correct IP Address? Are
there other alternatives I should be considering to secure this API that don't require our partner making changes?
Thanks,
Paul
LinkedIn
Twitter
