Chapter 7: API Management

Up to this point in this book, we've looked at Okta's fundamental functionality. When we've looked at giving users access, it's been to applications. In this chapter, we're taking a step into more advanced features, such as the Application Programming Interface (API) management of Okta and access to APIs of external applications. This can be both for an organization or Okta's APIs, as well as access to self-developed OpenID Connect applications. This is not a feature that every organization needs, but it's a feature that gives that little extra to the organization that needs it.

In this chapter, we will look at the following:

• API terminology
• Managing Okta with APIs
• API Access Management fundamentals
• API Access Management administration

API terminology

There is some terminology that we need to go through, to be able to understand all aspects of API management and API access management:

• API product: An application with a group of API endpoints. These endpoints can have different needs and use cases, but listen to the same authorization server to understand what a user or service can and cannot do. It also is the service that a user logs into using OpenID Connect with an ID token.
• API: These are the endpoints where data is available and interchangeable between systems depending on the request and resource and access grant.
• Authorization server: An authorization server is at its core an OAuth 2.0 minting machine, utilizing Okta's scopes, claims, and access policies. You can create authorization servers in Okta, typically one server per API product. The server is typically used for one use case rather than one endpoint.
• Scopes: Scopes are operations performed on your API endpoints. They are built...

Managing Okta with APIs

The use of APIs has been increasing and has become a large part of any organization's footprint. Within all departments, APIs are used to share, transfer, move, read, change, delete, and adjust data from any system to any system.

We might have to start by looking at what an API is and why Okta's functionality in this area is needed. Back in the early days, a web program was hosted on a web server and the browser only displayed its content through HTML sent from the server. These days, you might have apps on your smartphone or single-page apps, both that run code on your device or on the client. These apps connect with a backend service, usually exposed through an API. Simply put, you can say that services and applications that handle smaller tasks and connect and interact with each other through APIs are called microservices. As this newer model of applications becomes more and more common, finding a way of managing these APIs becomes more critical...

API Access Management fundamentals

Using APIs is beneficial because they are automatable and can be programmed to do just what is needed. In many cases, APIs are used by users to help their work be more automated and remove repetitive tasks. By connecting the APIs from different applications, users can all of a sudden see their data in different places, interact with it, and manipulate it where and how they want and like.

On the other side, developers and IT teams might invest in creating custom services and or applications to make their life, or that of their colleagues, better. Creating these applications usually entails adding APIs to open up data streams to collect and bring it all together.

Lastly, if your organization's business model is to build services or web products, chances are they'll be using APIs to connect to other applications, partners, systems, and so on.

All of these APIs require different needs, approaches, and management.

According to Okta...

API Access Management administration

So, let's go into the Okta administrator panel to set up some of the features that were examined in the last section. Navigate to Security | API. Here, we see that we have three tabs we can work with:

• Authentication Servers
• Tokens
• Trusted Origins

This is what it looks like in the admin panel:

Figure 7.3 – Available tabs for API management

As we already spoke about Tokens and Trusted Origins earlier in this chapter, we will now only focus on Authorization Servers. If you don't have the API Access Management product enabled, you will only see this menu for the default org authorization server, explained next.

Authorization server

To start off, we need to look at why you might need an authorization server. An authorization server is basically something to create and solidify (or mint, as it's normally called) Oauth 2.0 or OpenID Connect tokens. You can use it for authentication...