An API key identifies the application calling an API and can authorize requests at an API gateway. Kong's key-auth plugin requires consumers to provide the configured key in an x-api-key header. section 6.2.2
A gateway-based API-key setup includes:
- An OpenAPI security scheme declaring that the API uses an API key. section 6.2.2
- A Kong key-auth plugin configured to read the x-api-key header. section 6.2.2
- A consumer credential such as my_secret_api_key, which the client sends with the request. section 6.2.2
- A header-based design that avoids placing the key in a query parameter, where it risks being logged and exposed. section 10.2.3
Calling a secured gateway endpoint
Send the gateway request with both routing and authentication headers: curl --silent --header "Host: api.acme-pet-supplies.com" --header "x-api-key: my_secret_api_key" --request GET http://localhost:8000/v1/catalog/products/612b4280-b5c0-4ad5-bce7-ede7ab2b80fc | jq . . A successful request prints the product response. section 6.2.2
Listing 6.4 Kong API gateway declarative configuration
_format_version: "1.1"
services:
- name: Product_Catalog_API
protocol: http
host: localhost
port: 8080
path: /
routes:
- tags:
- Product Catalog
name: viewProduct
methods:
- GET #1
hosts: #1
- api.acme-pet-supplies.com #1
paths: #1
- /v1/catalog/products/(.+)$ #1
strip_path: false #1
plugins: #1
- name: key-auth #2
config:
key_names:
- x-api-key
consumers:
- username: my_api_consumer
keyauth_credentials:
- key: my_secret_api_key
Inspect the declarative Kong configuration to see the key-auth plugin, header name, consumer, and credential together. section 6.2.2
curl --silent --header "Host: api.acme-pet-supplies.com" --header "x-api-key: my_secret_api_key" --request GET http://localhost:8000/v1/catalog/products /612b4280-b5c0-4ad5-bce7-ede7ab2b80fc | jq .
Inspect the complete curl invocation used to send the API key to the gateway. section 6.2.2
