Key Auth Configuration

Parameters

See plugin common configurations for configuration options available to all plugins.

Credentials

The following are plugin attributes available for configurations on credentials.

• key — string · required

  A unique key that identifies the credential for a consumer. The key is encrypted with AES before being stored in etcd. You can also store it in an environment variable and reference it using the env:// prefix, or in a secret manager such as HashiCorp Vault's KV secrets engine, and reference it using the secret:// prefix. For more information, see secrets.

Routes or Services

The following are plugin attributes available for configurations on routes or services.

• header — string · optional · default: apikey

  The header to get the key from.

• query — string · optional · default: apikey

  The query string to get the key from. Lower priority than header.

• hide_credentials — boolean · optional · default: false

  If true, remove the configured credential header and query parameter before forwarding upstream. Before falling back to anonymous_consumer, the gateway also removes invalid credentials. Invalid-credential removal was introduced in API7 Enterprise 3.9.14 and 3.10.1, and in APISIX 3.17.0.

• anonymous_consumer — string · optional

  Anonymous consumer name. If configured, allow anonymous users to bypass the authentication. See Rate Limit with Anonymous Consumer for more details.

• realm — string · optional · default: key

  Realm in the WWW-Authenticate response header returned with a 401 Unauthorized response due to authentication failure. For example:

  • If realm is set to key-auth, the 401 response will include the following header:

    WWW-Authenticate: apikey realm="key-auth"

  • If realm is not configured, the 401 response will include the following header:

    WWW-Authenticate: apikey realm="key"

  This parameter is available in API7 Enterprise version 3.9.2 and later, and in Apache APISIX version 3.15.0 and later.