| description |
|---|
This page provides the technical details of the API Key policy |
You can use the api-key policy to enforce API key checks during request processing, allowing only apps with approved API keys to access your APIs.
This policy ensures that API keys are valid, have not been revoked or expired and are approved to consume the specific resources associated with your API.
Functional and implementation information for the api-key policy is organized into the following sections:
{% hint style="warning" %} This policy can be applied to v2 APIs and v4 HTTP proxy APIs. It cannot be applied to v4 message APIs or v4 TCP proxy APIs. {% endhint %}
{% tabs %}
{% tab title="HTTP proxy API example" %}
You can configure the policy in the APIM Gateway configuration file (gravitee.yml). You can customize the X-Gravitee-Api-Key header and api-key query parameter.
policy:
api-key:
header: My-Custom-Api-Key
param: custom-api-key{% endtab %} {% endtabs %}
Sample policy configuration:
{% code title="Sample Configuration" %}
"api-key": {
"propagateApiKey": false
}{% endcode %}
The phases checked below are supported by the api-key policy:
| v2 Phases | Compatible? | v4 Phases | Compatible? |
|---|---|---|---|
| onRequest | true | onRequest | true |
| onResponse | false | onResponse | false |
| onRequestContent | false | onMessageRequest | false |
| onResponseContent | false | onMessageResponse | false |
You can configure the api-key policy with the following options:
| Property | Required | Description | Type | Default |
|---|---|---|---|---|
| propagateApiKey | false | Propagate API key to upstream API | boolean | false |
The following is the compatibility matrix for APIM and the assign-metrics policy:
| Plugin Version | Supported APIM versions |
|---|---|
| 2.x | 3.x |
| 4.x | 4.0+ |
| Phase | Key |
|---|---|
| onRequest | API_KEY_MISSING |
| API_KEY_INVALID_KEY |
{% @github-files/github-code-block url="https://github.com/gravitee-io/gravitee-policy-apikey/blob/master/CHANGELOG.md" %}