---
title: "Get App Auth Strategy"
method: GET
path: "/v2/application-auth-strategies/{authStrategyId}"
tags: ["App Auth Strategies"]
---

# Get App Auth Strategy

`GET /v2/application-auth-strategies/{authStrategyId}`

Returns an application auth strategy.

## Response `200`

A response containing a single application auth strategy object.

- union — A set of plugin configurations that represent how the gateway will perform authentication and authorization for a Product Version. Called “Auth Strategy” for short in the context of portals/applications. The plugins are synced to any Gateway Service that is currently linked or becomes linked to the Product Version.
  - object — Response payload from creating or updating a Key Auth Application Auth Strategy
    - `id` string, uuid, required — Contains a unique identifier used by the API for this resource.
    - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
    - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
    - `strategy_type` 'key_auth', required
    - `configs` object, required — JSON-B object containing the configuration for the Key Auth strategy
      - `key-auth` AppAuthStrategyConfigKeyAuth, required — The most basic mode to configure an Application Auth Strategy for an API Product Version. Using this mode will allow developers to generate API keys that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for Key Auth.
        - `key_names` string[] — The names of the headers containing the API key. You can specify multiple header names.
    - `active` boolean, required — At least one published product version is using this auth strategy.
    - `dcr_provider` object, nullable, required
      - `id` string, uuid, required — Contains a unique identifier used by the API for this resource.
      - `name` string, required
      - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
      - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http', required — The type of DCR provider. Can be one of the following - auth0, azureAd, curity, okta, http
    - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
  - object — Response payload from creating an OIDC Application Auth Strategy
    - `id` string, uuid, required — Contains a unique identifier used by the API for this resource.
    - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
    - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
    - `strategy_type` 'openid_connect', required
    - `configs` object, required — JSON-B object containing the configuration for the OIDC strategy
      - `openid-connect` AppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application.
        - `issuer` string, url, required
        - `credential_claim` string[], required
        - `scopes` string[], required
        - `auth_methods` string[], required
        - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `active` boolean, required — At least one published product version is using this auth strategy.
    - `dcr_provider` object, nullable, required
      - `id` string, uuid, required — Contains a unique identifier used by the API for this resource.
      - `name` string, required
      - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
      - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http', required — The type of DCR provider. Can be one of the following - auth0, azureAd, curity, okta, http
    - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.dev/kong/apis/konnect-api.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kong/konnect-api/revisions/19bbc8a36404/schema)