Michelin Public IP addresses

API Key

API key validation is the simplest form of app-based security that you can configure for an API. A client app simply presents an API key with its request, then API manager checks to see that the API key is in an approved state for the resource being requested. Internally, your proxies use policies to verify API key authenticity.

High Level Steps:

• When a consumer registers an app for any API product in Apigee developer portal, a client id and client secret is created.
• Client Id is treated as API Key and used to authenticate the consumer for subsequent API calls.

OAuth 2

OAuth 2 is authorization mechanism for every request from the same consumer (only client_credentials grant type is supported at this moment within Michelin Apigee platform).

Using client id and client secret, consumer gets an access token which can be used for authorizing API calls. Once the token expires after predefined time, a new token has to be generated and used again.