2 API products containing 1 API proxy in common, are assigned to 1 Developer App, What API product will be populated in OAuth 2 flow variables?

[#1]

Imagine you have API proxy "APIPROXY" happily deployed on an org and environment.

APIPROXY has an Oauth 2 Verify Access Token Policy.

Then, you create 2 different API products:

• API Product A
• API Product B

BOTH containing same APIPROXY in same Environment, maybe different Rate limit settings.

Then you create a Developer App "MYAPP" and grant access to BOTH

• API Product A
• API Product B

Then, get an OAuth access token using "MYAPP"s client_id / client_secret and try to access "APIPROXY"

Assuming authentication of access token went OK, what would be populated in the API product flow variables given the ambiguity that the APIPROXY is in 2 different API products for the same App?

[anilsr]

Great Question @roberto.navas@millicom.com , Check comments in this answer which talks about same issue. @Vinit Mehta gave some answers regarding same.

[#3]

Thanks, I read that thread, however I see they recommend to use Access Entity Policy.... we found -the hard way- this is a BAD idea, since that policy is not optimized for high traffic... above 100K request per hour, it started to add ~1000 to 3000 msecs to the Proxy Response Time, just processing that policy.

In addition to that, it seems that policy returns an XML document, which needs another policy just to Extract the data you want from the XML to Flow variables.

[#4]

Hello roberto.navas@millicom.com,

In this case, you should be able to get any one of them at random. To get all the products you need to apply verify api key policy or access entity policy.

[DChiesa]

Interesting Question.

My answer is going to be a little bit different: Don't DO THAT!

DO NOT design your system so that a single proxy is in multiple products, and those multiple products are both authorized for a single developer app.

Eliminate the multiplicity, somewhere in the chain. It will make your life simpler.

[#6]

This is what I thought.... Apigee EDGE lets you do this, but it does not make much sense... Another issue would be that the Rate-limit may be different in API Product A vs. API Product B... so if the same App Developer has both API products, it is not clear which Rate limit to apply.

I'm looking for what Apigee engineers think about this?

[krishnanataraja]

@Dino is this ok to do if the products are deployed in different environments?

[dchiesa1]

It would not result in the uncertainty we've discussed.

As long as you (and the rest of the team) are not confused by the relationship, it won't be a problem.

ps: we don't speak of deploying products to environments. In Apigee Speak, you enable an API Product on environments. But I get your point!

[krishnanataraja]

Got it thanks.

[#10]

I think it should show array of products.