# API Gateways How to use an API gateway with a FusionAuth token. > For the index of this section of the site, see [llms.txt](https://4002.18-224-161-104.sslip.io/docs/llms.txt) FusionAuth is an OIDC and OAuth server, which means it integrates with a variety of third party systems out of the box. One of those systems is an API gateway. It is a common architectural pattern to have an authentication system generate a token which is then presented to other services. These services can sit behind an API Gateway, which offers throttling, billing and checks for authenticated requests. ## General Integration Guidance In general, you'll want to do the following to perform an API gateway integration using OIDC. In FusionAuth: * Create an Application in FusionAuth. * Record the **Client Id** and the **Client Secret**. * Provide the **Client Id** and the **Client Secret** to the web application which will complete the Authorization Code grant. This may be the API gateway or a custom application. * Add the configured redirect URL to the **Authorized redirect URLs** field. This may be the API gateway or a custom application. You typically need to ensure that FusionAuth is signing the JWT with an asymmetric key. Do that by navigating to Settings -> Key Master to create or import the key pair. Then configure the Application to use the key by navigating to Applications -> Your Application -> JWT . In the API gateway: * Provide the URL for FusionAuth, often called the `issuer`. * Configure the API gateway with the client Id, and sometimes the secret, from the Application. * Configure which claims of the JWT the API gateway should inspect. * Add routes in the API gateway to forward requests to services. If the API gateway does not support token exchange, but instead expects a token: * Create a web application which can receive the one-time Authorization Code and exchange it for an access token. Provide this web application with the client secret. * Have the web application securely provide the client the token. After this is configured, when the user tries to access a service, they'll be prompted to login. After they successfully do so, the API gateway will examine the token and allow access if applicable. FusionAuth also supports SAML integrations. Learn more about [how FusionAuth can act as a SAML IdP](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/saml.md). ## Sample Architecture Here's a sequence diagram with an example API gateway protecting two services. ```mermaid sequenceDiagram participant u as User participant f as FusionAuth participant te as Token Exchanger participant ag as API Gateway participant sa as Service A participant sb as Service B u ->> ag : Requests Service A ag ->> ag : Token validation failure (it doesn't exist) ag -->> u : Sends redirect to FusionAuth u ->> f : Authenticates f ->> f : Verifies credentials f -->> u : Redirects user to exchanger u ->> te : Requests token te -->> u : Issues token u ->> ag : Requests Service A and presents token ag ->> ag : Validates token ag ->> sa : Forwards request for Service A sa -->> ag : Data from Service A ag -->> u : Data u ->> ag : Requests Service B and presents token ag ->> ag : Validates token ag ->> sb : Forwards request for Service B sb -->> ag : Data ag -->> u : Data from Service B ``` API gateway sample architecture. ## Token Location The location of the token in the request is typically in one of two places: * The `Authorization` header * A secure, `HttpOnly` cookie The former is compatible with a variety of API gateways and open source libraries. The latter is more secure when used for browser based clients such as SPAs, since JavaScript doesn't have access to the token. It is also compatible with the [Hosted Backend APIs](https://4002.18-224-161-104.sslip.io/docs/apis/hosted-backend.md), which use FusionAuth to perform the token exchange. ## Example Integrations Here are some example API gateway integrations. [Amazon API Gateway Learn about the Amazon API Gateway JWT integration.](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/aws-api-gateway.md) [Cloudflare Worker Functions (API Gateway) Learn about the Cloudflare Worker Functions and JWT integration.](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/cloudflare-api-gateway.md) [HAProxy API Gateway Learn about the HAProxy JWT integration.](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/haproxy-api-gateway.md) [Kong Gateway Learn about the Kong Gateway JWT integration.](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/kong-gateway.md) [ngrok Cloud Edge Learn about the ngrok Cloud Edge OIDC integration.](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/ngrok-cloud-edge.md) [Securing your APIs with FusionAuth Learn about how to use FusionAuth to control access to an API.](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/api-authorization.md) [Hasura](https://hasura.io/learn/graphql/hasura-authentication/integrations/fusion-auth/) also provides external documentation for integrating with FusionAuth. Related [Get Started Authorization Hub Integrate with third party platforms, using FusionAuth to safely store refresh tokens. apiconsents](https://4002.18-224-161-104.sslip.io/docs/get-started/use-cases/authorization-hub.md) [SDKs Client Libraries and SDKs An overview of FusionAuth Client Libraries and SDKs. api](https://4002.18-224-161-104.sslip.io/docs/sdks.md) --- ## Other pages in Examples > For the full index of this section, see [Extend](https://4002.18-224-161-104.sslip.io/docs/llms-extend.txt). - [Docker Install](https://4002.18-224-161-104.sslip.io/docs/extend/examples/5-minute-intro/5-minute-docker.md): Use Docker and Docker Compose for the 5-minute guide. - [Fast Path Install](https://4002.18-224-161-104.sslip.io/docs/extend/examples/5-minute-intro/5-minute-fastpath.md): Use Fastpath and your own database for the 5-minute guide. - [Sandbox](https://4002.18-224-161-104.sslip.io/docs/extend/examples/5-minute-intro/5-minute-sandbox.md): Use the shared sandbox instance for the 5-minute guide. - [5 Minute Intro](https://4002.18-224-161-104.sslip.io/docs/extend/examples/5-minute-intro.md): This guide will walk you through the steps required to use FusionAuth for login and logout. - [Securing your APIs with FusionAuth](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/api-authorization.md): Learn about how to use FusionAuth to control access to an API. - [Amazon API Gateway](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/aws-api-gateway.md): Learn about the Amazon API Gateway JWT integration. - [Cloudflare Worker Functions (API Gateway)](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/cloudflare-api-gateway.md): Learn about the Cloudflare Worker Functions and JWT integration. - [HAProxy API Gateway](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/haproxy-api-gateway.md): Learn about the HAProxy JWT integration. - [Kong Gateway](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/kong-gateway.md): Learn about the Kong Gateway JWT integration. - [ngrok Cloud Edge](https://4002.18-224-161-104.sslip.io/docs/extend/examples/api-gateways/ngrok-cloud-edge.md): Learn about the ngrok Cloud Edge OIDC integration. - [Control MCP Server Access](https://4002.18-224-161-104.sslip.io/docs/extend/examples/controlling-access-mcp-server.md): Learn how to protect Model Context Protocol (MCP) servers with OAuth authentication using FusionAuth. - [Device Limiting](https://4002.18-224-161-104.sslip.io/docs/extend/examples/device-limiting.md): Learn how to limit the number of devices a user can log in to concurrently. - [Example Applications](https://4002.18-224-161-104.sslip.io/docs/extend/examples/example-repos.md): Learn about and download example application code for working with FusionAuth in many programming languages. - [Connect claude.ai And chatgpt.com To A FusionAuth-Protected MCP Server](https://4002.18-224-161-104.sslip.io/docs/extend/examples/mcp-clients-claude-chatgpt.md): Learn how to connect claude.ai and chatgpt.com to an MCP server protected by FusionAuth using Client ID Metadata Documents. - [Modeling Hierarchies](https://4002.18-224-161-104.sslip.io/docs/extend/examples/modeling-hierarchies.md): Using the FusionAuth Entity Management feature to model hierarchical organizations and users that belong to organizations. - [Modeling Organizations](https://4002.18-224-161-104.sslip.io/docs/extend/examples/modeling-organizations.md): Using the FusionAuth Entity Management feature to model organizations and users that belong to organizations. - [Multi-Application Dashboard](https://4002.18-224-161-104.sslip.io/docs/extend/examples/multi-application-dashboard.md): Create a dashboard page with a list of applications a user can log in to. - [Multi-tenancy](https://4002.18-224-161-104.sslip.io/docs/extend/examples/multi-tenant.md): Learn how to run multiple tenants in a single FusionAuth instance. - [Twilio Segment](https://4002.18-224-161-104.sslip.io/docs/extend/examples/twilio-segment.md): Populate your Segment user data with FusionAuth data.