This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.

Configure the header to carry the Bearer token

Owned by Former user (Deleted)
Last updated: Sept 11, 2018
6 min read

APIs published on the WSO2 API Cloud are secured using OAuth2.0 by default. Any client application invoking a secure published API needs to have a valid subscription to the particular API and present a valid OAuth2.0 Access Token to the API Gateway.

The HTTP Authorization header is the most common method of providing authentication information for REST APIs and it is used in API Cloud as well. The application needs to have the access token in the authorization header to authenticate the API that is being accessed. But, there can be reasons such as organizational policies, legacy backends expecting to use the authorization header for other purposes and legacy client applications which will force you to use some other header to pass the bearer token to the API gateway.

WSO2 API Cloud now allows you to define your own header to carry the bearer token to the API Gateway. This can be configured for the entire organization (all your APIs) or for certain APIs only.

Configure the header per API

When creating a new API or editing an existing API,

  1. Go to the Manage tab.

  2. Provide the name of the header which you wish to use as the authorization header, as shown below. In this example, it is defined as Token.

  3. Save and publish the API.
  4. When you go to the developer portal(API Store), you will be able to see the portal is ready to send the new header to the gateway. Instead of the usual Authorization header, you will see the Token header which was defined in the previous steps, as shown below.

  5. If you want to invoke the API with curl, following is the command.

    curl -k -X GET "<Your API URL>" -H "Accept: Application/json" -H "Token: Bearer <Your Token>"

Configuring the header for the entire organization

  1. Go to the management console of API Cloud. You will be logged in automatically.

  2. Click Main, then click Browse under Resources.

  3. Enter /_system/config/apimgt/applicationdata/tenant-conf.json as the location. Click Go to access the tenant-conf.json file in the WSO2 Registry.
  4. Click Edit as text to edit the JSON file.

  5. Add the following configuration with the customized authorization header to the JSON file and save the file.

  6. If you have APIs that were published already, go to the API publisher and re-publish the APIs for the changes to take effect. The new APIs will automatically have this behavior when they are created.

If you have configured this at both API level and organization level, then the API level configuration will get the precedence.


With this new feature is available in WSO2 API Cloud, you will be able to connect your legacy backends and legacy clients to the API gateway without worrying about the authorization header.