What's the best authentication strategy for API gateways?

The “best” authentication strategy for an API gateway is usually:

Use the gateway as an authentication enforcement point, but delegate identity verification to a dedicated IdP / authorization service using short-lived tokens (typically OAuth 2.0 / OpenID Connect with JWTs or opaque tokens).

Recommended default

1. External clients

• OAuth 2.0 / OpenID Connect
• Use JWT access tokens if services need to validate locally and you want low latency.
• Use opaque tokens + introspection if you want centralized revocation/control.

2. Service-to-service traffic

• mTLS for workload identity
• Optionally pair with JWT service tokens or SPIFFE/SPIRE for strong service identity.

3. Gateway role

The gateway should:

• Validate token signature, issuer, audience, expiry
• Enforce scopes/roles/claims
• Apply rate limits and abuse detection
• Forward trusted identity context to backend services

Why this is usually best

• Centralized control without hardcoding auth logic in every service
• Scales well for microservices
• Supports SSO, federation, and third-party clients
• Short-lived tokens reduce risk
• Keeps backend services simpler

Typical architecture

1. Client authenticates with IdP
2. Client sends access token to API gateway
3. Gateway validates token
4. Gateway forwards request to backend with identity claims or a signed internal token
5. Backend authorizes based on trusted context

Common pitfalls

• Don’t rely only on API keys for user auth
• Don’t make the gateway the only place where auth is checked if downstream services have sensitive data
• Avoid long-lived tokens
• Don’t use JWTs without proper iss, aud, exp, and key rotation validation

If you need a simple decision

• Public/mobile/web apps: OAuth 2.0 + OIDC
• Machine-to-machine: mTLS + client credentials
• High-scale with revocation needs: opaque tokens + introspection
• Internal microservices: service mesh identity (mTLS) or SPIFFE

If you want, I can also give you:

• a recommended setup by use case
• a comparison of JWT vs opaque tokens
• or a reference architecture for Kong / Apigee / AWS API Gateway / NGINX.