A city’s building-permit portal must reject callers unless a custom combination of API key header, department code, and an internal lookup succeeds. Standard JWT validation alone is not enough. Which API Gateway authentication approach should the developer choose?
Select an answer to reveal the explanation.
Short Explanation
Think of the gateway’s built-in JWT check as a standard lock that only understands one key shape. When the city needs a custom combination of headers plus a lookup, that lock is not enough—hand the decision to an authorizer function that can return allow/deny, scopes, and context. Native token validation stays for ordinary JWTs; custom rules belong in the authorizer.
Full Explanation
OCI API Gateway supports two authentication paths: native JWT/OAuth validation (JWKS, static keys, or introspection, including OCI IAM identity domains) and an authorizer function on OCI Functions. The authorizer receives request attributes and returns authentication results, access scopes, and optional context variables. Use native validation when a standard token is sufficient; use an authorizer when the check is custom—header combinations, lookups, or extra claims. The authorizer is not a substitute for the business back end.