Consume internal API as an application ¶

This how-to guides you through the steps required to consume an API secured with Entra ID as an application (or a machine user). This is also known as the machine-to-machine (M2M) or client credentials flow.

Prerequisites ¶

• The API you're consuming has granted access to your application

Configure your application ¶

Enable Entra ID in your application:

spec:
  azure:
    application:
      enabled: true

Depending on how you communicate with the API you're consuming, configure the appropriate outbound access policies:

spec:
  accessPolicy:
    outbound:
      rules:
        - application: <some-api>
          namespace: <some-team>

spec:
  accessPolicy:
    outbound:
      external:
        - host: <some-host> 

Acquire token ¶

Now you can request a new token for the API that you want to consume.

Send a HTTP POST request to the endpoint found in the NAIS_TOKEN_ENDPOINT environment variable. The request must have a Content-Type header set to either:

• application/json or
• application/x-www-form-urlencoded

The body of the request should contain the following parameters:

POST ${NAIS_TOKEN_ENDPOINT} HTTP/1.1
Content-Type: application/json

{
    "identity_provider": "entra_id",
    "target": "<environment>:<team>:<other-api-app-name>"
}

POST ${NAIS_TOKEN_ENDPOINT} HTTP/1.1
Content-Type: application/x-www-form-urlencoded

identity_provider=entra_id&
target=<environment>:<team>:<other-api-app-name>

{
    "access_token": "eyJra...",
    "expires_in": 3599,
    "token_type": "Bearer"
}

Your application does not need to validate this token.

Consume API ¶

Once you have acquired a new token, you can finally consume the target API by using the token as a Bearer token:

GET /resource HTTP/1.1

Host: api.example.com
Authorization: Bearer eyJraWQ...

Related pages ¶

📚 Entra ID reference