Pass a Custom Authorization Token to the Backend

When you send an API request to the backend, you pass a token in the Authorization header of the request. The API Gateway uses this token to authorize access, and then drops it from the outgoing message. In this tutorial, we explain how to pass a custom authorization token that is different to the authorization token generated by the API Cloud to the backend.

Let's get started.

1. Download and install the WSO2 API Manager Tooling Plug-in if you have not done so already. Open Eclipse after installation. 

2. Click Window > Open Perspective > Other to open the Eclipse perspective selection window. Alternatively, click the Open Perspective icon shown below at the top right corner.

   

3. On the dialog box that appears, click WSO2 APIManager and click OK.
   
4. On the APIM perspective, click the Login icon as shown below.
   
5. On the dialog box that appears, enter the cloud URL, username (in the format <email@company_name>), and password of the Publisher server.
   
6. On the tree view that appears, expand the folder structure of the existing API.
7. Right-click on the in sequence folder and click Create to create a new in sequence.
   

8.  Name the sequence TokenExchange.
   

9. Your sequence now appears on the APIM perspective. From under the Mediators section, drag and drop a Property mediator to your sequence and give the following values to the mediator.

   Tip: The Property Mediator has no direct impact on a message, but rather on the message context flowing through Synapse. For more information, see Property Mediator in the WSO2 ESB documentation.

   Property Name	New Property
   New Property Name	Custom
   Value Type	EXPRESSION
   Value Expression	get-property('transport', 'Custom')

   

10. Similarly, add another Property mediator to your sequence and give the following values to the mediator.

    Property Name	New Property
    New Property Name	Authorization
    Value Type	EXPRESSION
    Value Expression	get-property('Custom')
    Property Scope	transport

    

11. Add a third Property mediator to your sequence and give the following values to the mediator.

    Property Name	New Property
    New Property Name	Custom
    Property Action	remove
    Property Scope	transport

    

12. Save the sequence. 

13. Right-click on the sequence and click Commit File to push the changes to the Publisher server.
    

    Let's create a new API and engage the sequence you created to it.

14. Log in to the API Publisher, click the Add link, and give the information in the table below.

    Field	Sample value
    Name	TestAPI1
    Context	/test1
    Version	1.0.0
    Visibility	Public

    

15. Leave the Resources section blank, and click Implement. When prompted, add a wildcard resource (/*). Click Yes and then click Implement again to move to the Implement tab.
     

16. In the Implement tab, give the information in the table below. 

    Field	Sample value
    Endpoint type	HTTP endpoint
    Production endpoint	http://wso2cloud-custom-auth-header-sample-1-0-0.wso2apps.com/custom-auth-header/validate-header

    

17. Select the Enable Message Mediation check box, engage the In sequence that you created earlier, and click Manage.
    

18. In the Manage tab, select the Gold tier.    
     

19. Click Save and Publish to publish the API to the API Store.
    Let's subscribe to the API and invoke it.

20. Go to the API Store by clicking the Go to API Store link at the top right-hand corner of the screen. If you are not logged in already, use the same credentials that you used to log in to the API Cloud.

21. Click TestAPI1, and subscribe to the API using an available application and the Gold tier. If there are no applications available by default, create one. 
    

22. Click the APPLICATIONS menu, and click the application that you used to subscribe to the API with (DefaultApplication, in this example). Go to its Production Keys tab, and re-generate its access token. By default, access tokens expire an hour after application creation.
    

23. Install any REST client on your machine. We use cURL here.

24. Go to the command-line, and invoke the API using the following cURL command. In this command, you pass the token that the backend expects, i.e., 1234, in the Custom header with the authorization token that the system generates in the Authorization header. 

    curl -H "Authorization: Bearer <access token>" -H "Custom: Bearer 1234" <API URL>

    Note the following:

    • <access token> is the token that you got in step 20.
    • <API URL> appears on the API's Overview page in the API Store. Copy the HTTP endpoint. If you select the HTTPs endpoint, be sure to run the cURL command with the -k option.

    Here's an example:

    curl -H "Authorization: Bearer DNp94L7mAT0e3Oj0QuUxOrmSIt0a" -H "Custom: Bearer 1234" 'http://gateway.api.cloud.wso2.com:8280/t/companyn1/test1/1.0.0'

25. Note the response that you get in the command line. According to the sample backend used in this tutorial, you get the below response.

    {"code":200,"message":"Authorization header validation successful"}

In this tutorial, you passed a custom token that the backend expects along with the system-generated Authorization token, and invoked an API successfully by swapping the system's token with your custom token.