How Ippen Digital Secured API Access Across 80 Companies with Traefik Hub

Company Profile

Ippen Digital
51–250 Employees
Digital Media
Germany

The Challenge

Ippen Digital operates one of the leading technology platforms for digital news in Germany. Around 80 media brands run on its infrastructure, with ~2,000 journalists using the platform reaching approximately half of the German population monthly. The organization faced a complex infrastructure challenge: how to secure their APIs across the company and implement role-based access control across dozens of companies, each relying on different identity providers—from Google Workspace to Microsoft Entra—while running everything on an AWS-hosted Kubernetes stack.

The complexity ran deep. Different companies within the conglomerate maintained their own identity infrastructure, and Ippen Digital had no control over how partner organizations configured their identity providers. Users needed to log in with their existing corporate credentials without creating new accounts, and the system had to support both inter-company permissions (Company A gets different access than Company B) and intra-company roles (a journalist has different rights than a manager within the same organization). Machine-to-machine communication for planned external service integrations added another layer of requirements.

Previous Approach

Ippen Digital's engineering teams had each independently built their own authentication solutions to secure their APIs. Some built around Google Authentication, others around Microsoft Entra. This fragmentation resulted in duplicated effort across teams, inconsistent enforcement, and no single governing layer to unify how identity was handled org-wide.

Solution

Ippen Digital selected Traefik Hub API Management, deployed across production and pre-production environments on AWS Kubernetes. The platform serves as the comprehensive API management layer handling authentication, authorization, and role-based access control for their multi-tenant media platform. The team leverages Traefik Hub's JWT API Auth for token validation across multiple identity providers, its managed subscription and application system for governing API consumption, and its operation sets for fine-grained control over API methods and paths. OIDC middleware handles single sign-on flows, while OPA (Open Policy Agent) integration enables advanced policy-based routing decisions.

Implementation

Ippen Digital adopted an incremental deployment strategy, starting with MVP testing on a staging environment before gradually onboarding production services. The team deliberately kept the migration path flexible—requests that didn't yet route through Traefik could still reach backend services directly, allowing a service-by-service rollout without requiring a big-bang cutover.

The implementation journey included productive technical collaboration with Traefik Labs' engineering team. During one troubleshooting session, the team discovered that a catch-all route with an auto-assigned higher priority was intercepting requests meant for more specific API routes—a subtle issue that was quickly resolved by understanding Traefik's routing priority algorithm. The team also upgraded to a release candidate build to access multilayer routing capabilities, enabling them to layer OIDC authentication on a first routing pass before applying API management authorization on a second pass. All configuration was managed as code through Kubernetes CRDs, aligning with the team's engineering culture.

Impact

The adoption of Traefik Hub fundamentally expanded Ippen Digital's architectural capabilities beyond their original expectations. What began as a search for an authentication and routing layer evolved into a comprehensive API management strategy. The discovery of features like operation sets, which enable precise control over which API endpoints and HTTP methods are accessible to different consumers, addressed requirements the team had documented long before knowing such tooling existed. As one engineer noted, "I really, really am excited about the operation sets. This means you can really lock things down."

The configuration-as-code approach proved particularly valuable for managing complex multi-tenant access policies through version-controlled Kubernetes CRDs rather than error-prone manual workflows. The team also gained confidence in their infrastructure resilience planning through Traefik Labs' pragmatic partnership approach — including support for potential emergency environment deployments on the AWS European Sovereign Cloud.

Recommendation

"When you're managing authentication and API access across 80 companies with different identity providers, you need a solution that's both flexible and robust. This is why we chose Traefik Hub. The API management layer with operation sets, managed subscriptions, and configuration as code gave us the tools to properly govern who can see and consume our APIs at scale. The Traefik team has been genuinely collaborative, working with us through complex architecture decisions rather than just selling us a product."

Patrick Fink, Director Platform & Data, Ippen Digital

About Ippen Digital

Ippen Digital operates one of the leading technology platforms for digital news in Germany. Around 80 media brands run on its infrastructure, reaching approximately half of the German population each month.