Apigee是否提供类Auth0的用户身份认证存储，抑或仅支持应用级OAuth认证？

Great question—let’s break this down clearly since you’re already familiar with Auth0 and working with Apigee on GCP:

Core Difference in Purpose #

First, it’s important to clarify: Apigee is not designed as an identity provider (IDP) like Auth0, so it does not offer built-in user identity authentication storage functionality. Apigee’s core focus is API lifecycle management—things like traffic routing, rate limiting, monitoring, and enforcing security policies at the API gateway level—rather than storing user credentials, managing user profiles, or handling end-user authentication flows.

Apigee’s OAuth Implementation: More Than Just Consumer Key/Secret #

While Apigee doesn’t store user identities, its OAuth support goes far beyond just application-level authentication with Consumer Key/Secret:

• Application-level auth (Client Credentials flow): This is the out-of-the-box use case where you use Consumer Key/Secret to authenticate service-to-service calls (no end-user involved).
• Support for end-user-focused OAuth2 flows: Apigee can handle flows like Authorization Code, Implicit, and even Password Grant (though the latter is not recommended for security). However, for these flows, Apigee relies on an external IDP (like Auth0) to handle the actual user authentication, issue tokens (e.g., JWTs), and manage user identities.
• Token validation & policy enforcement: Once an external IDP issues a token, Apigee can validate its signature, check claims (like user roles, scopes), and enforce access control policies to ensure only authorized users/apps can access your APIs.

Recommended Approach for Your Stack #

Given your setup (Auth0 familiarity, GCP-deployed APIs, Apigee for API management), the ideal workflow is:

1. Use Auth0 as your IDP: Handle all user registration, login, multi-factor authentication, and token issuance (JWTs with custom claims like user roles or permissions).
2. Configure Apigee as your API gateway: Set up policies to validate Auth0-issued JWTs (verify signature against Auth0’s public keys, check token expiry, validate scopes/claims) before routing requests to your backend APIs.
3. Leverage Apigee’s other features: Use its rate limiting, caching, monitoring, and transformation capabilities to manage the full API lifecycle alongside the security layer provided by Auth0.

This setup plays to the strengths of both tools: Auth0 manages identity complexity, while Apigee handles API-specific security and operations.

内容的提问来源于stack exchange，提问作者Frank