Connect frontend and backend authentication
A frontend signs users in and calls a protected backend.
Kinde · Module
APIs API
Kinde API registration gives an API a name and unique audience, then lets you authorize applications to use it. A linked API can be included in access-token audience claims for backend authentication.
How it works
Register an API in Kinde by giving it a name and unique audience, then authorize applications that need to call it. Linking the API to an application allows the API audience to appear in access-token claims for backend authorization.
Key points
- Use API registration when your application exposes backend data or operations through an API.
- Registration supports authenticated communication between the frontend and backend.
- Associate the registered API with a Kinde application to connect the API to the application's authentication configuration.
- A registered and linked API can appear as the access token's aud claim.
- Start API registration from the environment's APIs settings page.
- The registration form requires an API name and an audience value.
Common mistakes
- Choose an audience that uniquely identifies the API; it is not merely a display label.
- Treat the generated API ID and saved audience as immutable details.
Example: Register an API conceptually
const audience = "https://api.example.com";
console.log({
apiName: "Orders API",
audience,
tokenClaim: "aud"
});A minimal illustration of the stable concepts: an API has a name and unique audience, which can be included in an access token's aud claim.
When to use it
Identify an API through the aud claim
A service needs its identity represented in access tokens.
Register and authorize multiple APIs
An organization manages several backend services.
Interview questions
QWhat are the essential steps to register an API in Kinde?
Registering an API gives it a name and audience, where the audience uniquely identifies the API. After saving it, authorize the relevant application so the API can be used in that application's access-control setup.
Follow-up: How can an API become an access-token audience? Link the registered API to a Kinde application; the API can then be included in the token's aud claim.
QWhat is an API audience and how should it be chosen?
The audience is the identifier used for the API, commonly a short code or the API URL. It provides the value that identifies the intended backend API.
Follow-up: What should be done if the audience needs to change? Because the documentation says the audience is not editable, create or register the appropriate API identity rather than relying on an in-place edit.
QHow do you allow an application to use a registered API?
After creating the API, open the relevant application and authorize it for that API. This connects the application to the API for authenticated access.
Follow-up: How can access be narrowed further? Define API scopes and manage which scopes the application is allowed to use.
Related
API scopesKinde applicationaud claimOpenAPI specAPI keys