Implementing API Security with Auth0

Auth0

We’re going to use the Auth0 online platform for our API security. We’ll need to log in (or sign up) at the website, define our API in the Auth0 system, and collect key authentication parameters that we’ll need in order to access the secured API (for example, our access token). We’ll also learn how to validate access tokens with the JWT website.

Once we have that taken care of, we can modify our API service to support secure connections, and then we can test that using the access token supplied by Auth0. But first, let’s log in to our security provider and define our secure API.

Logging in to Auth0

The first step in adding security to our API is to log in to http://auth0.com. We’re using Auth0 because we can start small and build up a more complex security profile as we need it. Our company may be using a different external service, or we may want to implement one of our own. The important thing here is to understand the key concepts so that we can translate them to our own environment.

If you already have an Auth0 account, just go to the homepage and click the “Login” button. If you need to create an account, visit the “Sign Up” page to get started.

Once we sign up, we’ll see our main Auth0 dashboard, as shown below. We’ll use this screen quite a bit throughout this chapter.