What Reaches Your Backend

Apiway decides who may call which operation before a request is forwarded. A request without the right entitlement never reaches your service at all. This page is about the requests that do: what arrives with them, and the small amount your service does with it.

What arrives with every request

The caller’s access token — the one Apiway issued to that customer, person or AI agent. It is forwarded to your service with the request.

Who is calling is in the token itself. Once your service has validated it (below), its claims tell you:

which customer the call is for — the https://apiway.net/identity/claims/tenantid claim;
which client made it — sub, the caller’s own credential;
what it may do — its scopes, already checked against the caller’s entitlements for this operation before the request reached you.

Your service does not have to trust anything the caller put in the path, the query or the body to find out who they are.

For a person, their profile details — name, email — are available from UserInfo with the same token (GET /oauth2/v2/userinfo). UserInfo describes the person; the customer always comes from the token.

How your service knows the request is genuine

Validate the token as you would any OpenID Connect token, and check that its issuer is Apiway. Standard auth middleware in every major framework does this for you: configure Apiway as the only accepted issuer, and it rejects any token that was not issued by Apiway. A request carrying some other token — or none — is refused before your code runs.

Keeping customers’ records apart

The tenant comes from the token, never from the request, so a caller cannot claim to be someone else. Your service answers for that tenant only — and customer A asking for customer B’s order finds nothing and gets a 404: the record is never found, and A never learns it exists.

Moving existing customers

If your customers already call your API with credentials you issued:

Machine-to-machine clients — their client secrets can be migrated, so their integrations keep working.
People who sign in through your identity provider — nothing changes. They keep signing in with the credentials they have.

And you do not have to move everyone at once. Apiway can run more than one gateway side by side — the one you have today and the one you are moving to — so you move across gradually — one API at a time, and one customer at a time — while both keep serving. See Multi-Gateway.