API Key Policy

Phase

onRequest	onResponse
X

Description

API Key policy lets you enforce verification of API keys during request processing, letting only apps with approved API keys access your APIs.

This policy ensures that API keys are valid, have not been revoked or expired, and are approved to consume the specific resources associated with your API.

Configuration

Policy level

You can configure the policy with the following options :

Property	Required	Description	Type	Default
propagateApiKey	-	Propagate API Key to upstream API	boolean	false

Configuration

"api-key": {
  "propagateApiKey": false
}

Gateway level

It is also possible to customize the X-Gravitee-Api-Key header or api-key query parameter. This can be done from gateway configuration file (gravitee.yml):

Configuration

policy:
  api-key:
    header: My-Custom-Api-Key
    param: custom-api-key