Managing API users

You can define API users to restrict access to APIs based on API keys.

Creating API users

1. Go to API Gateway > API User, and select the API User tab.
2. Click Create New.
3. Configure these settings:
   

   Name	Enter a name that identifies the user.
   Email	Type the email address of the user that is used for contact purpose.
   Comments	Optionally, enter a description or comments for the user.
   Type	Standard Once the API user is created successfully, an API key and UUID are automatically assigned to this user by FortiWeb. In cases such as the key is stolen or lost, you click the Refresh button to refresh the key. Dynamic FortiWeb adopts RSA algorithm to generate token. It uses public key to encode, and private key to decode a random string with minimum length 64. You need to enter the RSA key for dynamic key. JWT JSON Web Token (JWT) is an open standard (RFC 7519) that defines a way for transmitting information –like authentication and authorization facts– between two parties: an issuer and an audience. For the JWT key, you need to enter the value for the required fields so that FortiWeb can communicate with the JWT server to validate the key. For how to get the API key, see "Retrieve the API key for the user".
   RSA Key	Enter the RSA key (Private key) of the user. Available only if the Type is Dynamic.
   Restrict Access IPs	Restrict this API key so that it may only be used from the specified IP addresses. Both single IP addresses or IP ranges are supported. You can enter multiple IP addresses by adding .
   Restrict HTTP Referers	Restrict this API key so that it may only be used when the specified URLs are present in the Referer HTTP header. This can be used to prevent an API key from being reused on other client-side web applications that don’t match this URL (but note that this does not prevent server-side reuse where the referer could be forged). Now only full URL such as https://example.com/foo is supported. You can enter multiple referers by adding .

4. Click OK.
   You can continue creating multiple API users.
   Once the API user is created successfully, an API key and UUID are automatically assigned to this user by FortiWeb. The API key and UUID can not be changed, while you can append IP or HTTP referer restrictions for this user. Refer to the following steps to get the API key for this user.

Retrieve the API key for the user

After the user is created, you need to perform the following steps to retrieve the API key.

1. Go to API Gateway > API User, and select the API User tab.
2. Select the user you just created.
3. Click Edit.
4. You can see the API key generated for this user in the API Key field.
5. Copy the key and securely share the Key with the API User.

When the API user makes API request to your application, it must carry the API key in requests, such as: API_Key: xxxx-xxxx-xxxx.

Special note for Dynamic Key

For API users configured with a dynamic key, each API request to your application must include both the API Key and Dynamic Key.

• API Key: This is the API key generated by FortiWeb. Refer to the earlier steps for how to obtain it.

  When an API request is received, FortiWeb validates the API key to ensure it is legitimate. In the API Gateway rule, you can specify where the API key is located (e.g., header, parameter) and define the name of the field FortiWeb should look for.

• Dynamic Key: You are responsible for generating the token of this key. Below are the steps for your reference.

  When an API request is received, FortiWeb also validates the Dynamic key to ensure it is legitimate. It will look for the dynamic_key field in the request.

To generate the token of the dynamic key:

1. We assume that you have already generated a RSA key pair:
   • Private Key: It will be used to decrypt tokens provided by the user. This should have already been entered in FortiWeb in the RSA Key field when creating the Dynamic API user.
   • Public Key: You will need it to generate the token in the following step.
2. Use the following method to generate the token:

   Token=base64Url(RSA(KeyP, Num)).base64url(HS256(Num, email))

   • KeyP: Your RSA public key
   • Num: A random number
   • email: The user's email address (must match the email entered in FortiWeb when creating this API user)
3. Copy the generated token. Then, provide both the API key and token to the user.

Creating API user group

You can assign API users to a certain group which defines the specific permissions of the group users can perform.

1. Go to API Gateway > API User, and select the API User Group tab.
2. Click Create New.
3. In Name, type a name that can be referenced by other parts of the configuration.
4. Click OK.
5. Click Create New.
6. For API User, select the created API user from the drop-down list.
7. Click OK.
   You can continue adding more API users to the group.