apidays Helsinki & North 2025 - API access control strategies beyond JWT bearer tokens, Judith Kahrer (Curity)

API access control strategies beyond JWT bearer tokens
Judith Kahrer, Identity Expert at Curity

apidays Helsinki & North 2025 - APIs for Innovation, Intelligence, and Impact
June 3 & 4, 2025

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. API Access Control Strategies Beyond JWT Bearer Tokens
2. Judith Kahrer Identity Expert API Security Specialist Author https://curity.io/cloud-native-data-security-oauth/
3. Common Token-based Architecture Services API Gateway Application
4. Token Replay Services API Gateway Application
5. Sender-constrained Tokens “cnf” : { <reference to public key> }
6. Proof • mutual TLS (RFC 8705) • self-signed JWT (DPoP, RFC 9449)
7. Mutual TLS Services API Gateway Application Transport Layer
8. Certificate-bound Access Tokens Services API Gateway Application Transport Layer
9. Certificate-bound Access Tokens – Token Replay Services API Gateway Application
10. Certificate-bound Access Tokens – Proxy Services API Gateway Application No key
11. Certificate-bound Access Tokens – Proxy Services API Gateway Application
12. Certificate-bound Access Tokens • Great support for mTLS • Third-party Assertion • Built-in Authentication • Public Key Infrastructure (PKI) • Complex Operation • Certificate Rollout
13. Demonstrating Proof of Possession (DPoP) Services API Gateway Application Application Layer
14. Demonstrating Proof of Possession (DPoP) Services API Gateway Application
15. Demonstrating Proof of Possession (DPoP) Services API Gateway Application
16. DPoP – Token Replay Services API Gateway Application No proof
17. DPoP – Token Replay Services API Gateway Application
18. Demonstrating Proof of Possession (DPoP) • Suitable for all Applications • Runtime Keys • End-to-End Solution • Complex Validation
19. Token Validation • Issuer • Scope • Audience
20. What to Secure?
21. What are the Rules?
22. Identity Attributes
23. Why JSON Web Tokens?
24. JWT Access Token iss: trusted-party sub: Judith exp: 1749046500 scope: invoice …
25. Common Token-based Architecture Services API Gateway Identity Attributes Application
26. Confidentiality Risk Services API Gateway May parse JWT May parse JWT Application
27. Improved Token-based Architecture Services API Gateway Opaque Token Application
28. Improved Token-based Architecture Services API Gateway Application
29. Benefits • Local Changes Only • Confidentiality • Privacy • Trust Boundary • Token Translation
30. Token Translation Services API Gateway Different
31. Transaction Tokens Services API Gateway Bound to Transaction
32. Access Control Strategies • Validate access tokens whenever data is returned. • Use sender-constrained access tokens. • Use JWTs for APIs, opaque tokens for clients. • Limit scope for internal tokens.
33. Thank You! curity.io developer.curity.io info@curity.io
34. Cloud Native Data Security with OAuth https://curity.io/cloud-native-data-security-oauth/