...
- ✅ Use environment variables (or in Key Vault)
- ✅ Rotate periodically (every 6-12 months)
- ❌ Never commit to git
- ❌ Never hardcode in source files
...
Token Validation
How IntegrationServiceAPI validates tokens:
Signature Validation
- Uses Azure AD's public keys
- Proves token was issued by Azure AD
- Prevents forged tokens
Issuer Validation
- Checks token came from correct Azure AD tenant
- Prevents tokens from other organizations
Audience Validation
- Ensures token is for IntegrationServiceAPI
- Prevents token reuse across different APIs
Expiration Validation
- Checks token hasn't expired (1 hour)
- Includes 5-minute clock skew tolerance
Permission Validation
- Checks ApiService has required permissions
- Based on Azure AD app role assignments
...
Configuration
ApiService Configuration
What's needed:
| Setting | Description | Example Value |
|---|---|---|
| Client ID | ApiService's application ID | 4dad5d62-dc8c-4378-8bd0-ae736a4d73fe |
| Client Secret | ApiService's secret key | abc123~XYZ789-VerySecret |
| Tenant ID | Azure AD tenant | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |
| Scope | IntegrationServiceAPI scope | api://bd5100ee-af63-4880-8c60-47d4207d60c1/.default |
Where configured:
- Environment variables (recommended)
appsettings.json(development only, with secrets.json)
...
IntegrationServiceAPI Configuration
What's needed:
| Setting | Description | Example Value |
|---|---|---|
| Client ID | IntegrationServiceAPI's ID | bd5100ee-af63-4880-8c60-47d4207d60c1 |
| Client Secret | IntegrationServiceAPI's secret key | xyz789~ABC123-VerySecret |
| Tenant ID | Azure AD tenant | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |
| Scope | ApiService scope | api://4dad5d62-dc8c-4378-8bd0-ae736a4d73fe/.default |
Where configured:
- Environment variables (recommended)
appsettings.json(development only, with secrets.json)
...
Quick Reference
ApiService
| Property | Value |
|---|---|
| Client ID | 4dad5d62-dc8c-4378-8bd0-ae736a4d73fe |
| Needs Client Secret | ✅ Yes (calls IntegrationServiceAPI and validates tokens) |
| Tenant ID | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |
...
IntegrationServiceAPI
| Property | Value |
|---|---|
| Client ID | bd5100ee-af63-4880-8c60-47d4207d60c1 |
| Needs Client Secret | ✅ Yes (calls ApiService and validates tokens) |
| Tenant ID | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |