Yes, the backend needs to be a public url. Apigee needs to be able to call the backend from its servers/message processors. If your backend is inside a VPN or behind a firewall you may first need to write a web service that exposes only those parts of the backend that will be used by Apigee. There are multiple ways you can do this and you can put whatever authorization you want in front of the service, but Apigee needs to be able to reach it in order to work.
LinkedIn
Twitter
