Secure APIs in Choreo

Question

I wrote a sample ballerina code in choreo API to return x-jwt-header header value to the caller.

when I turn off the security for that API, the header value is not there in the request headers. Does it mean the API is unsecured?

I want to crate an unsecured API. I want to know whether the header values will be there or not?

Answer 1

When you disable the security, basically API is exposed without security to the consumers. Hence the API is unsecured. x-jwt-header is used to pass the enduser data to the backend services. If you don't provide an access token when invoking API, then it can't send the enduser information to the backend services. That's why you are getting the response without that header.