Skip to main content

API Gateways

The Corsha mIDP integrates with API gateway platforms to add machine identity authentication and zero-trust access control to API traffic. These integrations enable organizations to protect existing API infrastructure with continuous multi-factor authentication (MFA) and policy-based enforcement.

Available Integrations​

F5 BIG-IP​

Integrate Corsha with F5 BIG-IP to add machine identity authentication to API traffic flowing through your F5 infrastructure. Leverages F5's flexible policy framework to enforce Corsha MFA credentials.

Key capabilities:

  • MFA credential validation for API requests
  • Integration with F5 Access Policy Manager (APM)
  • Support for per-request policies and HTTP connectors
  • TLS/mTLS support for secure communication
  • Custom iRule logic for credential extraction

Kong Gateway​

Native Kong Gateway plugin for seamless integration with the Corsha mIDP. Enables Kong administrators to protect API services managed by Kong with Corsha's machine identity authentication.

Key capabilities:

  • Native Kong Gateway plugin
  • Per-service or global policy configuration
  • Automated protection against API exploits (MitM, credential stuffing, machine spoofing)
  • Simple integration with existing Kong environments
  • Compatible with Kong Enterprise and OSS

How API Gateway Integrations Work​

API gateway integrations follow a common pattern:

  1. Client Authentication: A Corsha Authenticator deployed alongside the API client generates one-time-use MFA credentials
  2. Credential Injection: The Authenticator adds the Corsha credential to the request headers (typically X-Corsha-Cred)
  3. Gateway Interception: The API gateway intercepts the request before forwarding to the upstream service
  4. Credential Validation: The gateway extracts the credential and validates it with the Corsha mIDP
  5. Policy Enforcement: Based on the validation response, the gateway either allows or blocks the request
  6. Upstream Forwarding: Valid requests are forwarded to the protected API service

Benefits​

Zero-Trust API Security:

  • Enforce continuous MFA for all API traffic
  • Prevent unauthorized access to APIs even with compromised credentials
  • Validate machine identity on every request
  • Eliminate long-lived API keys and static credentials

Seamless Integration:

  • Deploy into existing API gateway infrastructure
  • No changes required to upstream API services
  • Native plugins and policy frameworks for popular gateways
  • Centralized policy management through Console

Enhanced Visibility:

  • Monitor all API authentication attempts
  • Track violations and blocked requests
  • Correlate API traffic with machine identities
  • Unified view of API access across gateways

Defense in Depth:

  • Layer machine identity authentication on top of existing API security
  • Combine with API gateway rate limiting, throttling, and other policies
  • Integrate Corsha MFA with gateway authentication flows
  • Support hybrid deployment models (on-premises, cloud, multi-cloud)

Configuration​

API gateway integrations are configured through both the gateway platform and the Console:

Gateway Configuration:

  • Deploy Corsha plugin or configure policy framework
  • Set up HTTP connectors or authentication validators
  • Configure SSL/TLS profiles for secure communication with Corsha mIDP
  • Define routing policies for credential validation

Corsha Configuration:

Integration Setup

Contact your Corsha Technical Point of Contact (TPOC) for assistance configuring API gateway integrations and obtaining necessary credentials.

Best Practices​

  1. Deploy Authenticators with Clients: Ensure every API client has a Corsha Authenticator deployed to inject credentials

  2. Use TLS/mTLS: Enable TLS between gateway and Corsha mIDP, and between clients and gateway

  3. Centralize Policy Management: Manage connection rules and protocol enforcement through Console rather than duplicating policies in gateways

  4. Monitor Validation Failures: Track credential validation failures to identify misconfigured clients or attack attempts

  5. Plan for High Availability: Deploy gateway integrations with redundancy and failover capabilities

  6. Test Before Production: Validate integration in non-production environments before deploying to production APIs