api-key.md

description
This page provides the technical details of the API Key policy

API Key

Overview

You can use the api-key policy to enforce API key checks during request processing, allowing only apps with approved API keys to access your APIs.

This policy ensures that API keys are valid, have not been revoked or expired and are approved to consume the specific resources associated with your API.

Functional and implementation information for the api-key policy is organized into the following sections:

• Examples
• Configuration
• Compatibility Matrix
• Errors
• Changelogs

Examples

{% hint style="warning" %} This policy can be applied to v2 APIs and v4 proxy APIs. It cannot be applied to v4 message APIs. {% endhint %}

{% tabs %} {% tab title="Proxy API example" %} You can configure the policy in the APIM Gateway configuration file (gravitee.yml). You can customize the X-Gravitee-Api-Key header and api-key query parameter.

policy:
  api-key:
    header: My-Custom-Api-Key
    param: custom-api-key

{% endtab %} {% endtabs %}

Configuration

Sample policy configuration:

{% code title="Sample Configuration" %}

"api-key": {
  "propagateApiKey": false
}

{% endcode %}

Phases

The phases checked below are supported by the api-key policy:

v2 Phases	Compatible?	v4 Phases	Compatible?
onRequest	true	onRequest	true
onResponse	false	onResponse	false
onRequestContent	false	onMessageRequest	false
onResponseContent	false	onMessageResponse	false

Options

You can configure the api-key policy with the following options:

Property	Required	Description	Type	Default
propagateApiKey	false	Propagate API key to upstream API	boolean	false

Compatibility matrix

The following is the compatibility matrix for APIM and the assign-metrics policy:

Plugin Version	Supported APIM versions
2.x	3.x
4.x	4.0+

Errors

Phase	Key
onRequest	API_KEY_MISSING
	API_KEY_INVALID_KEY

Changelogs

{% @github-files/github-code-block url="https://github.com/gravitee-io/gravitee-policy-apikey/blob/master/CHANGELOG.md" %}