Without Apigee, we had a API which needed to be registered in Okta for user to authenticate before getting access to the API. This API obtained user context from Okta token.
Then, we adopted Apigee and set Okta as OAuth2.0 Server for Apigee.
Question 1: Do I need to now register two APIs in Okta 1. The API Proxy which I create in Apigee and 2. The original API, so that it can still create User Context from the Okta token which gets forwarded to it by API Proxy?
Question 2: Should we also validate token from backend API also (along with validating token from API proxy) or is it acceptable to have no Authentication in our backend APIs going forward?
Thanks,
Ashish
LinkedIn
Twitter
