A redwing-marsh mobile app must prove it subscribed to a protected APIM product. What credential does the app send on each call?
Select an answer to reveal the explanation.
Short Explanation
Protected product means subscription key—after the redwing-marsh app subscribes, send that key on every call (header or query).
Full Explanation
For a protected APIM product, the redwing-marsh mobile app proves subscription by sending the subscription key issued after Subscribe—typically in a header such as Ocp-Apim-Subscription-Key or as a query parameter, per the product’s configuration. That key is the default access credential for product-scoped calls through the gateway and is what partners copy from the developer portal after a successful subscription.
Embedding a Microsoft Graph directory role assignment in the URL path is not how APIM product access works and would leak authorization concepts into routes while failing gateway key checks. Using a management-plane access token from a portal screenshot confuses control-plane admin authentication with data-plane caller credentials and is unsafe to distribute. Reusing an Azure Storage account key as the API product secret mixes unrelated secret types and is not the APIM subscription model.
Exam caveat: subscription keys authorize product access at the gateway; they are separate from Entra bearer tokens used when JWT validation policies are also configured for identity-aware APIs.
Operational check: subscribe the mobile app’s developer account to the protected product, copy the primary or secondary key from the portal, call the API with the key in the documented header, and confirm failure without the key versus success with it for redwing-marsh traffic.