API Providers
For platform owners, backend engineers, security teams, and architects who operate API services and make them available to API consumers via the Swift API platform.
Previous page Error Codes
Next pageAuthentication
For platform owners, backend engineers, security teams, and architects who operate API services and make them available to API consumers via the Swift API platform.
The Swift Developer Portal supports API Providers in securely publishing, managing, and scaling APIs on the Swift API platform. This page serves as the starting point for organizations that expose APIs through Swift and want to ensure secure authentication, reliable traffic management, and clear visibility into API consumer interactions.
Swift API Gateway authenticates to the API provider’s servers. As part of the Swift security model, the gateway mandates one of the following authentication configurations for all provider endpoints:
Option 1: Mutual TLS (mTLS) Only
Option 2: OAuth on Top of Mutual TLS
Providers should select the model that best align with their security posture and regulatory obligations.
To integrate with the Swift API platform, API provider web servers must be configured with Swift-issued web server certificates. Certificates are used to establish trusted mTLS connections with the Swift API gateway. Proper certificate installation and renewal are required to maintain uninterrupted connectivity. Configuration guidance is provided to ensure compatibility with common web server technologies. This setup ensures secure, authenticated communication between Swift and the API provider infrastructure. In addition to certificate configuration, API providers must ensure appropriate network and firewall rules are in place to allow Swift API Gateway connectivity.
Swift supports session distribution, allowing traffic to be distributed across multiple API provider web servers and load balance among registered provider endpoints based on weights set by the API provider. This capability improves availability, resiliency and reduces the operational burden on API providers to manage external traffic distribution.
When Swift routes requests to an API provider, the Swift API gateway forwards a mandatory request header, X-UserContext, which contains information about the API consumer. X-UserContext is a JWT (JSON Web Token) generated and signed by Swift. The JWT structure, claims, signature verification, and validation requirements are fully documented and should be treated as part of the provider’s security boundary.