How about in reverse? How would you implement if the API service is in the cloud/Azure and needs to be invoked by an on-premise application? What are the security mechanisms that need to be in place?