How to secure APIM subscription key when calling APIs from Web Client Application

Question

Hello,

What are some secure ways to pass the Azure API Management (APIM) subscription key while calling APIs, without exposing it in the browser network tab? Passing the key inside the header is not ideal as it can be exposed in the network tab. Would configuring the APIM subscription key inside the Azure Key Vault help to secure it from hardcoding and also hide the secret values when calling APIs from a web client application?

Best regards,

Abhishek

Answer 1

Hi @Abhishek Sinha ,

You cannot hide or encrypt the APIM key as APIM will not be able to authenticate the request if you have encrypted the Ocp-Apim-Subscription-Key header or if you are not passing this header. The service needs the subscription key without encryption since it is the first step to authenticate the request.

One option would be to have a middle services/proxy that makes a front end call and a middle/service proxy that makes the call to APIM using the plain text subscription key. Another option would be to enable JWT bearer token enabling to secure the API.

The Azure security baseline for API Management document contains guidelines around to secure your cloud solutions on Azure and security controls defined by the Azure Security Benchmark, as well as guideliness applicable to API Management.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.