Use API Keys

This page describes how to use API keys in API Gateway.

Overview

An API key is a string that identifies a Google Cloud project for quota, billing, and monitoring purposes. Developers generate an API key in a project in the Google Cloud console. They then embed that key in every call to your API as a query parameter or in a request header.

If you specify an API key requirement in your API config, API Gateway uses the API key to look up the associated Google Cloud project. API Gateway rejects requests unless the API key was generated in your Google Cloud project or within other Google Cloud projects in which your API has been enabled.

Create an API key

Create an API key, or view API keys already available within your Google Cloud project, go to the APIs & Services > Credentials page and complete the steps described in Create an API key.

Go to Credentials

Configure API key authentication for API Gateway

Configure API key authentication for API Gateway to secure access to your gateway using an API key, as described in the following sections.

  1. Enable API key support for your service.

    Google Cloud console

    Do the following:

    1. In the Google Cloud console, go to APIs & Services > Library.

      Go to APIs & Services Library

    2. In the search bar, enter the Managed Service name of the API. You can find this value in the Managed Service column for your API on the APIs landing page. For example: 
      my-api-123abc456def1.apigateway.my-project.cloud.goog
    3. Click the service card to view the landing page.
    4. On the landing page for your service, click Enable.

    Google Cloud CLI

    Enter the following command, where MANAGED_SERVICE_NAME specifies the name of the managed service created when you deployed the API. This can be viewed in the Managed Service property listed with the gcloud api-gateway apis describe command.

    gcloud services enable MANAGED_SERVICE_NAME

    For example:

    gcloud services enable my-api-123abc456def1.apigateway.my-project.cloud.goog
  2. Modify the OpenAPI specification used to create your API config to include instructions to enforce an API key validation security policy on all traffic. Add the security type and securityDefinitions or securitySchemes as shown:

    OpenAPI 2.0