a6-plugin-key-auth

Overview

The key-auth plugin authenticates requests using API keys. Clients include a key in a header, query parameter, or cookie. APISIX looks up the key against consumer credentials and, on match, forwards the request with consumer identity headers. On failure it returns 401 Unauthorized.

When to Use

• Protect routes with simple API-key authentication
• Identify which consumer is calling an API
• Combine with rate-limiting for tiered access (authenticated vs anonymous)
• Hide credentials from upstream services

Plugin Configuration Reference (Route/Service)