AEM Headless authentication in Publish Environment

[DhinuBa]

At Present, We use content fragments in AEM and we have multiple team consume CF using assets API.
I noticed that in my environment, the api request to author instance  requires authentication whereas request exposed by the publish instance are served without authentication. 
I need to expose the api through the dispatcher to internet but I would like to be authentication protected. What does adobe recommended solution for this implementation? 

[narendragandhi]

Hi @DhinuBa 

The recommendation is to use the new OpenAPI based apis. Please refer this documentation for the list of available APIs - https://developer.adobe.com/experience-cloud/experience-manager-apis/

This also covers your concern for the authentication. Hope this helps!

Thanks

Narendra

[Aditya_Chabuku]

Hi @DhinuBa ,

These 3 simple steps would help you to expose API to 3rd party consumers or your SPA FE.

Step 1: Expose API via Dispatcher

Step 2: Require Authentication via OAuth/JWT

Step 3: Implement Token Validation in AEM

Refer these links for more details

https://experienceleague.adobe.com/en/docs/events/adobe-developers-live-recordings/2021/feb2021/api-... 

Once its all done, You will need to create Content Fragments suitable for API Delivery, Here is the API Schema that helps https://developer.adobe.com/experience-cloud/experience-manager-apis/api/experimental/sites/delivery... 

Hope this helps,

[DhinuBa]

This works fine for author. When it comes to publisher, it works even without authentication. Our use case is, we should not allow to retrieve content without authorization in publisher as well.

[kautuk_sahni]

@DhinuBa Did you find the suggestions helpful? Please let us know if you need more information. If a response worked, kindly mark it as correct for posterity; alternatively, if you found a solution yourself, we’d appreciate it if you could share it with the community. Thank you!

[Karthik_2]

Hi @DhinuBa ,
Did you find any solution for this issue?

[DhinuBa]

No, Still I am looking for a solution

[Karthik_2]

Checkout this doc, where it says content can be protected using CUGs, 
Protected content in AEM Headless | Adobe Experience Manager