# How does API Access Management work?

**URL:** <https://devforum.okta.com/t/how-does-api-access-management-work/1875>\
**Category:** Questions\
**Created:** [May 29, 2018, 9:07pm UTC](https://devforum.okta.com/t/how-does-api-access-management-work/1875 "2018-05-29T21:07:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kenny\_compute](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@kenny\_compute](https://devforum.okta.com/u/kenny_compute)\
**Post date:** [May 29, 2018, 9:07pm UTC](https://devforum.okta.com/t/how-does-api-access-management-work/1875/1 "2018-05-29T21:07:53Z")

</div>

I have read through the [API Access Management guide](https://developer.okta.com/use_cases/api_access_management/) and don’t quite understand how to actually go about securing my API. Say I have an endpoint `/foo` hosted on my backend serves and want to secure it. What are the steps that I need to take to allow only authorized callers to access the endpoint?

---

<div class="post-metadata">

**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\
**Post date:** [May 29, 2018, 11:01pm UTC](https://devforum.okta.com/t/how-does-api-access-management-work/1875/2 "2018-05-29T23:01:05Z")

</div>

In order to understand API Access Management, you need to understand the basics of OAuth 2.0 spec.  
[https://www.oauth.com/](https://www.oauth.com/) is a good reference to start with. Or you could read the RFC if you’re interested - [https://tools.ietf.org/html/rfc6749](https://tools.ietf.org/html/rfc6749)

At a high level, oauth 2.0 describes various “flows” to secure your APIs depending on the type of the client application.  
You can read through the various flows here - [https://developer.okta.com/standards/OAuth/#basic-flows](https://developer.okta.com/standards/OAuth/#basic-flows)

Once you understand the basics, you will know that Okta will act as an Authorization Server in these flows, which is responsible for minting access tokens that in turn will be used to secure your APIs.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 12, 2024, 11:12pm UTC](https://devforum.okta.com/t/how-does-api-access-management-work/1875/3 "2024-01-12T23:12:04Z")

</div>

Closed on January 12, 2024, 11:12pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.