Question

A financial services company exposes internal microservices to trusted partner banks through a cloud API gateway. Security requires that both the calling partner service AND the receiving API prove their identities cryptographically before any request payload is processed, preventing spoofed clients even if a partner's API key were leaked. Which control best satisfies this requirement?

Accepted Answer

Enforce mutual TLS (mTLS) with client and server certificates at the API gateway

Answer

Require an OAuth 2.0 bearer token in the Authorization header for each request

Answer

Rotate partner API keys automatically every 24 hours via the secrets manager

Answer

Add an IP allow-list restricting access to known partner network ranges