Unauthenticated API collections ​

Configure an API proxy collection to accept unauthenticated requests so any caller can reach its endpoints without an access profile, key, or token. By default, every endpoint on the Workato API platform requires an authenticated client.

Use unauthenticated collections to serve endpoints that a standard protocol requires to be reachable without credentials. The most common case is an OpenID Connect (OIDC) discovery document, such as /.well-known/openid-configuration, which client applications fetch to auto-discover a provider's authorization, token, and user info endpoints and its signing keys (JWKS). Refer to OpenID Connect for more information about OIDC on the API platform.

How unauthenticated access works ​

Unauthenticated access is a collection-level setting. When you enable it for an API proxy collection, every endpoint in that collection accepts requests without credentials, and Workato doesn't check for a client key or token. The setting applies to the whole collection, not to individual endpoints.

Clients and access profiles continue to exist for the collection, but they no longer restrict access while unauthenticated access is enabled. The client creation flow does not change. The setting persists when you deactivate and reactivate the API proxy.

Allow unauthenticated requests for a collection ​

You configure unauthenticated access from the collection details panel of an API proxy collection.

Complete the following steps to allow unauthenticated requests for an API proxy collection:

Deny unauthenticated requests ​

Complete the following steps to restore authentication for the collection:

Client access for unauthenticated collections ​

When a collection accepts unauthenticated requests, the clients listed on the collection's Clients tab can't restrict access, because any caller can reach the endpoints without credentials.

On the API collections page, a collection that accepts unauthenticated requests displays an Authentication not required indicator on its card in place of the client access count.

Call an unauthenticated endpoint ​

A consumer calls an endpoint in an unauthenticated collection through the collection's URL, with no Authorization header, key, or token. For example:

curl https://api.example.com/oidc/.well-known/openid-configuration

When the collection accepts unauthenticated requests and the proxy is active, Workato returns the response.

Response caching ​

Response caching remains available for endpoints in an unauthenticated collection. Enable caching for each endpoint as usual. Refer to API endpoint caching for more information.

Limitations ​

Unauthenticated API collections have the following limitations:

• Unauthenticated access is available only for API proxy collections. API recipe and AI gateway collections are not supported.
• API access policies, including rate limits and request limits, don't apply to unauthenticated collections.
• Allowed and blocked IP rules don't apply to unauthenticated collections.