Controlling API access through OAuth tokens in Tyk (oss)

We have created an OAuth API which generates the OAuth tokens with below steps -

  1. Created API Definition and security policy as defined here
  2. Create OAuth client by giving client_id, policy_id and redirect_uri.
  3. Triggered the call to generate token successfully.
  4. Used that token to call another API successful. This API and token API are added in the same security policy.

We want to have only one API which generates the OAuth tokens and with this token consumer should be able to call multiple APIs.

For this to work we need to add all the APIs in the same security policy. When a OAuth client is create then it will have access to all the APIs present in that security policy.

How can we restrict consumer to call only few APIs and not all of them?

For example while creating a Key we can specify the api_ids as an arrays and using that key consumer will have access to only those APIs.

How can we achieve the same if consumer is using OAuth tokens without creating multiple OAuth /token endpoints?

Has anyone implemented this before?

Do we have scope concept in Tyk Gateway which can be used to restrict API access for an OAuth token?

Hey @Anup_Rai
We’d recommend using a 3rd Party IDP for this kind of flow. Implementing this directly on the gateway starts getting a bit tricky.
We do have a PR on Github [wip] support more complex scope / role objects from JWT claims by asoorm · Pull Request #3529 · TykTechnologies/tyk · GitHub
that seeks to deal with more complex scope handling.

Cheers, Gregor