 default, which means services will accept both encrypted and unencrypted traffic to allow traffic from non-mesh services to remain functional. After onboarding all your services to the mesh, you can <a href=/v1.19/docs/tasks/security/authentication/mtls-migration/>change the authentication policy to only allow encrypted traffic</a>. You can then be certain that all your traffic is encrypted.</p><h3 id=istios-two-types-of-apis>Istio&rsquo;s two types of APIs</h3><p>Istio has APIs for platform owners and ser