How do I expose internal APIs to partners without opening up the whole network?

A good pattern is to publish only the specific API surface you want partners to use, while keeping the rest of your internal network private. In practice, this usually means putting a controlled gateway or proxy in front of your internal services.

Common approach

1) Put an API gateway / reverse proxy in front

Use an API gateway to expose only approved routes, methods, and versions.

It can handle:

• Authentication / authorization
• Rate limiting and quotas
• Request/response transformation
• Logging and auditing
• TLS termination
• IP allowlisting / partner-specific access rules

Examples: Kong, Apigee, AWS API Gateway, Azure API Management, NGINX, Envoy.

2) Keep internal services on private networks

Your actual services should stay behind:

• Private subnets / VPC networks
• Internal load balancers
• Firewall rules that only allow traffic from the gateway
• Service mesh or private service-to-service networking

That way, partners never talk to internal services directly.

3) Expose only a “partner API” layer

Create a dedicated façade for external consumers:

• Separate API domain, e.g. partners.example.com
• Separate auth model and scopes
• Separate rate limits and SLAs
• Possibly separate backend services or read-only replicas

This avoids leaking internal implementation details.

Recommended security controls

• Strong auth: OAuth2 client credentials, mTLS, signed JWTs, or API keys plus additional controls
• mTLS for high-trust partners
• IP allowlisting if partners have stable egress IPs
• Least privilege: only the endpoints they need
• Per-partner rate limits and quotas
• Schema validation and input sanitization
• Audit logs and anomaly detection
• WAF if internet-facing
• Secrets management and rotation

Network patterns

Option A: Public API gateway + private backend

Best when partners need internet access.

Flow: Partner -> Public API Gateway -> Private internal services

Option B: Private connectivity

Best for larger/enterprise partners.

Use:

• VPN
• Direct Connect / ExpressRoute / Interconnect
• Private peering / PrivateLink-style services

Flow: Partner network -> Private link/VPN -> Partner API endpoint -> Internal services

Option C: B2B API sandbox

Provide a separate sandbox environment for partners to test against, isolated from production.

What to avoid

• Opening internal subnets to partner IPs directly
• Exposing databases, message brokers, or admin interfaces
• Reusing internal service endpoints as partner endpoints
• Relying only on “security by obscurity”

A practical target architecture

1. Partner sends requests to a public API endpoint
2. API gateway authenticates and authorizes
3. Gateway enforces quotas, schema checks, and logging
4. Gateway forwards only allowed requests to private services
5. Internal services return responses through the gateway
6. Internal network remains unreachable from the partner side

If you want, I can also sketch:

• a reference architecture diagram
• a cloud-specific setup for AWS/Azure/GCP
• or a minimal secure implementation checklist