Hi Alexandre,

With regards to the Okta Authorization Servers that comes with the API Access Management we do recommend 1 authorization server per API product. You can find more details around what we would recommend via the two links i provided below, please read through these and let me know if you have any additional questions on this topic.

Authorization Server - Recommendations :- https://developer.okta.com/use_cases/api_access_management/#authorization-server

API Gateway Recommendations :- https://developer.okta.com/use_cases/api_access_management/#api-gateway-optional

Thanks,

Chris Hancock

Hi Chris,

Thank you for the links and the advice. These was really interesting to read but open additional questions:

1. If the best practice is to create dedicated OAuth 2.0 Clients' Access Policies this means that we could potentially end up with a lot of Policies to enforced on a AuthZ server. (As every API implementation is a oAuth Client) - do you have some figures to share around capacity limits? performance impacts?
2. Finally, about having 1 AuthZ server per API Product. Is it a technical limitation to distribute the potential load or is it a conceptual split to facilitate the API administration? I am asking that because we are targeting to have multiple API Products with a lot of cross product interactions. In such case, the pain will be on our customer. They will have to generate a Token for each of our API Products to make their calls.

Thank you again for your help,

Alexandre.

Hi Alexandre,

The recommendations are provided as a good grounding for utilising the authorisation server but will not fit all use cases. As such you may wish to review the API Rate limits found here: https://developer.okta.com/docs/api/getting_started/rate-limits. This highlights the rate limits that are applied, 

Authorize request to a custom Authorization Server:

"/oauth2/{authServerId}/v1/authorize"

This has a rate limit ranges from 100 - 600 calls per minute based on the edition of Okta you are using, as such if you have multiple apps using the same authoirsation server this will be fine as long as the number of auth calls does not exceed that limit.

If you are able to work out the expected calls being made from your applications and the peak times if any then the above should help in identifying the best approach for your environment.