We talked about the contributions of the API gateway for attaining the intended success of the microservices architecture pattern. The API gateway is the first entry point for client services and it works thereafter on behalf of the client services. However, the challenge is how to do user identification, authentication, and authorization. That is, how to communicate the identity of user agents/requesting services to the requested services to kick-start the task as per the expressed intention.
The API gateway authenticates the request and passes an access token (for example, JSON Web Token, https://jwt.io/) that securely identifies the requestor in each request to the services. A service can include the access token in requests it makes to other services.