APIM Gateways

An API Management (APIM) Gateway is a server that acts as a single entry point for all incoming API requests from clients (like mobile apps or websites) to your backend services.

By integrating ThunderID with your gateway, you can enforce authentication and authorization at the network boundary before requests ever reach your backend services.

ThunderID acts as the token authority. It issues signed JWT access tokens to authenticated clients, exposes a JWKS endpoint for public key distribution, and publishes an OpenID Connect discovery document. Your API gateway uses these to cryptographically verify every incoming token at the edge.

For request-time authorization, ThunderID can act as an AuthZEN Authorization API policy decision point (PDP). Your gateway or gateway-specific integration can request an authorization decision before forwarding traffic to the upstream service.

Select your API gateway to get a step-by-step integration guide with ThunderID.

Apache APISIX

Azure API Management

Envoy

Kong Konnect

KrakenD

How It Works

The JWT and scope-based authorization integrations follow the same pattern across all supported gateways:

• Application obtains a token: A client application authenticates with ThunderID using the client credentials grant and receives a signed JWT.
• Application calls the gateway: The client sends the JWT as a Bearer token in the Authorization header.
• Gateway validates the token and enforces authorization: The gateway fetches ThunderID's JWKS (cached after the first request) and cryptographically verifies the token's signature, issuer, and expiry. Optionally, the gateway checks that the token carries the required permission scopes. Tokens missing required scopes are rejected with 403 Forbidden.
• Gateway forwards the request: Valid, authorized requests are forwarded to the upstream service.

For AuthZEN PDP integrations, the gateway validates the token and requests an authorization decision from ThunderID. The authorization request includes the subject, resource, action, and request context. ThunderID returns an allow or deny response before the upstream service receives the request.