🛡️ Security

Consumer Key and Secret

The client credential pair an API management platform issues to a registered application, used to obtain access tokens as that application. Exporting every registered application's consumer keys and secrets was the goal watchTowr attributed to attackers forging admin tokens against WSO2 gateways.

📚 Deep Dive

Learn Article

Why an API Management Plane Is a Credential Vault for Every Backend It Fronts

An API gateway stores every client's keys, every backend's address and credentials, and the power to redirect traffic. Why it belongs at tier zero and what changes once it is classified that way.

intermediate 6 min read

Back to Glossary