Figure 6-158 OAuth-based API security 276  Accelerating Modernization with Agile Integration We can now choose from a range of options to add sophistication to how we secure access to  the API. In this section we will enable OAuth to control access. IBM API Connect supported by DataPower provides advanced security features, which  include but are not limited to, OAuth, JWT, encryption, throttling, etc. As described in section  4.9, “Cloud-native security – an application-centric perspective” on page 128 we can cover  many different use cases. We will demonstrate how to secure your API with OAuth token. We will also discuss the JWT  token generation. First you must identify which scheme you want your flow to follow. For more information, see  the following article: https://www.ibm.com/support/knowledgecenter/en/SSMNED_5.0.0/com.ibm.apic.toolkit.d oc/tutorial_apionprem_security_OAuth.html To choose an OAuth scheme. You must first establish whether your implementation is  considered public or confidential. This will narrow your choices to three schemes. A brief  outline of each scheme and the characteristics of the three public and three confidential  schemes follows. In our example here, we will use a Confidential (For internal application) scheme with  password flow to demonstrate how to secure the API. A confidential scheme is suitable when an application is capable of maintaining the secrecy of  the client secret. This is usually the case when an application runs in a browser and accesses  its own server when it gets OAuth access tokens. As such, these schemes make use of the  client secret. In Figure 6-159 we are showing the overall scenario, in which the developer initiates the  request using one of the available channels (mobile, web), then the application uses the  confidential scheme to obtain the token from the gateway. Then if authorized, the application  calls the back-end microservice to get the data. Logical component API Management (APIC) Consolidated, secured  API OAuth Provider