Securing a unified permitting API, the team must decide where authentication is declared on API Gateway. Which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Authentication is the building’s front-door rule for the whole deployment—one authorizer or token policy—not a different ID vendor on every hallway. Set that first, then tighten individual routes with authorization.
Full Explanation
API Gateway authentication is declared once for the entire deployment as a request policy: an authorizer function OCID or gateway-native token validation, plus whether anonymous clients are allowed. Individual routes do not each name a different identity provider. Establish deployment-level authentication first, then apply per-route authorization.