api-gateway-oauth2.bal

import ballerina/http;
import ballerina/graphql;

listener http:Listener apiGateway = new(9090,
    secureSocket = {
        key: {
            certFile: "/path/to/public.crt",
            keyFile: "/path/to/private.key"
        }
    }
);

@http:ServiceConfig {
    auth: [
        {
            oauth2IntrospectionConfig: {
                url: "https://localhost:9443/oauth2/introspect",
                clientConfig: {
                    customHeaders: {"Authorization": "Basic YWRtaW46YWRtaW4="},
                    secureSocket: {
                        cert: "/path/to/sts-public.crt"
                    }
                }
            },
            scopes: ["customer"]
        }
    ]
}
service /foo on apiGateway {
    resource function post bar() returns json|error {
        // business logic
    }
}

@graphql:ServiceConfig {
    auth: [
        {
            oauth2IntrospectionConfig: {
                url: "https://localhost:9443/oauth2/introspect",
                clientConfig: {
                    customHeaders: {"Authorization": "Basic YWRtaW46YWRtaW4="},
                    secureSocket: {
                        cert: "/path/to/sts-public.crt"
                    }
                }
            },
            scopes: ["customer"]
        }
    ]
}
service /bar on new graphql:Listener(apiGateway) {
    resource function get foo() returns json|error {
        // business logic
    }
}