Skip to content
Art2link ESB v2.02 LTS HomeDocumentationBlogContact
Best practices/Authenticate at the boundary

Authenticate at the boundary

Proving identity to the outside world is the job of the port and its adapter. Keep authentication and credentials at that boundary — never threaded through a map, component or custom function. The edge handles who you are; the inside handles what the message means.

Security and transformation are different concerns, and mixing them weakens both. A token fetched inside a map, a password embedded in a component, an API key passed through business logic — each scatters secrets across artifacts, makes rotation a hunt, and entangles “is this caller allowed” with “what does this field map to.” The transformation layer should be able to assume the connection is already trusted.

Configure authentication where the connection is actually made: on the receive or send port and its adapter, using the platform’s authentications rather than inline secrets. The message arriving on the bus is then already authenticated, and everything inside reasons purely about content. This also keeps credentials externalized and rotatable in one place.

outside world port + adapter (auth) inside — reasons about content only maps components no secrets here
If a map or function holds a secret, it is doing the boundary’s job. Move the credential onto the port’s authentication and let the logic stay security-free.