Anypoint Platform separates end-user administrative authentication (SSO) from API consumer security (OAuth 2.0):
OAuth 2.0 Authorization Code Flow
Used for interactive consumer applications where users delegate access without exposing credentials:
Client Credentials: Token Validation vs. JWT Claim Validation
- Token Introspection (Remote Validation): The API Gateway calls the Identity Provider (IdP) introspection endpoint on every request (or with caching) to verify token status.
- JWT Claim Validation (Local Validation): The API Gateway cryptographically verifies token signatures using the IdP's JWKS (JSON Web Key Set) public keys locally without an out-of-band network call.
Anypoint Platform SAML 2.0 Single Sign-On (SSO)
Enterprise users authenticate against corporate identity providers (such as Okta, Ping, or Azure AD) using SAML 2.0 assertions to gain access to Anypoint Platform control plane features:
