# Authentication, authorization and encryption for APIs

*MuleSoft Integration Foundations Study Guide · Recognize and interpret essential integration concepts and terminology · Last updated November 2, 2026 · https://www.certifyforce.com/study-guide/mulesoft-integration-foundations/essential-integration-concepts-and-terminology/authentication-authorization-and-encryption-for-apis*

MuleSoft's three principles of API security (identity and access management, content integrity and confidentiality, reliability and availability), how tokens, OAuth 2.0, signatures and encryption fit into them, and which part of Anypoint Platform secures users, APIs and threats.

- Certification: Salesforce MuleSoft Integration Foundations
- Exam section: Recognize and interpret essential integration concepts and terminology
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-integration-foundations

**Official exam objective:**

> Define and describe the core concepts of API and enterprise system security.

## What the exam expects

- Distinguish authentication (who the caller is) from authorization (what the caller may do) in a security requirement.
- Explain token-based credentials, multi-factor authentication and OAuth 2.0 at concept level.
- Match a requirement to message confidentiality (encryption) or message integrity (digital signatures), and separate both from availability measures.
- Name the Anypoint Platform part that secures platform users, the one that secures API traffic, and the one that watches for attacks.

Key terms:
- **Authentication**: establishing who a user or application is.
- **Authorization**: deciding what that authenticated user or application can do.
- **Message integrity**: assurance that a message was not modified after it was sent.
- **Message confidentiality**: assurance that nobody but the intended parties saw the message's contents.
- **OAuth 2.0**: an open protocol for authorizing apps to access resources without revealing user credentials to them.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Perimeter and data controls | Zero trust, WAF, tokenization, masking, a centralized API gateway | [Best practices](https://www.mulesoft.com/api/security/best-practices) |
| Anypoint Security for Runtime Fabric | Separate licence; proxies inbound and outbound traffic; Secrets Manager stores TLS certificates and keystores | [Anypoint Security](https://docs.mulesoft.com/anypoint-security/) |
| Authentication vs authorization | Who someone is vs what they can do | [API security guide](https://www.mulesoft.com/api/security/what-is-api-security) |
| Token-based credentials | Token issued at first sign-in; the app sends the token, not the credentials | [API security guide](https://www.mulesoft.com/api/security/what-is-api-security) |
| Digital signature | Receiver recomputes the signature and compares it with the incoming one | [API security guide](https://www.mulesoft.com/api/security/what-is-api-security) |
| Encryption named in best practices | TLS 1.3 in transit, AES-256 at rest | [Best practices](https://www.mulesoft.com/api/security/best-practices) |
| Rate limiting purpose | Prevents DDoS attacks | [Best practices](https://www.mulesoft.com/api/security/best-practices) |
| OAuth token enforcement (Mule OAuth provider) | Validates tokens, does not generate them | [OAuth policy](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement) |
| Client ID Enforcement failure | 401 for invalid or unauthorized client credentials | [Client ID Enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| External identity providers | OpenID Connect or SAML 2.0, up to 25 IdPs | [Identity management](https://docs.mulesoft.com/access-management/external-identity) |
| Platform sign-in, environments, SSO | Access Management | [Platform security](https://docs.mulesoft.com/general/security) |

## Check yourself

- What does multi-factor authentication add after the user's credentials are checked?
- Why does a digital signature reveal tampering?
- When does the Client ID Enforcement policy return a 401?
- Which two single sign-on standards can Anypoint Platform use with an external identity provider?

## Sources

- [Guide to Maximizing your API Security](https://www.mulesoft.com/api/security/what-is-api-security)
- [API Security Best Practices](https://www.mulesoft.com/api/security/best-practices)
- [Anypoint Platform Security](https://docs.mulesoft.com/general/security)
- [Access Management Overview](https://docs.mulesoft.com/access-management/)
- [Configuring Identity Management in Anypoint Platform](https://docs.mulesoft.com/access-management/external-identity)
- [Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/connected-apps-overview)
- [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement)
- [OAuth 2.0 Access Token Enforcement Using Mule OAuth Provider Policy](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement)
- [Examine APIs and Web Services (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/application-networks-and-api-led-connectivity-in-mulesoft/examine-apis-and-web-services)
- [Anypoint Security Overview](https://docs.mulesoft.com/anypoint-security/)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 4 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Integration Foundations pack (USD $19): https://www.certifyforce.com/practice-exams