1

According to Cloud Endpoint docs, it seems like you have to pass the API key in the URL itself as a query parameter.

However, that makes us vulnerable to man in the middle attacks. I was wondering if there was a way to have it work by passing the API key in the header instead.

I am working on a simple app which does not have any sign-in methods integrated already. Is there any alternative way of authentication in Cloud Endpoints where I am not required to add any existing sign-in method but will be able to use API keys securely.

4 Answers 4

4

I tried to define it as described into the openAPI v2 spec

securityDefinitions:
  api_key:
    type: "apiKey"
    name: "x-key"
    in: "header"

And I got this error message when deploying my Cloud Endpoint definition.

WARNING: service.yaml: apiKey 'x-key' is ignored. Only apiKey with 'name' as 'key' and 'in' as 'query' are supported

So, it's not possible.

3
  • Sorry but what is the purpose to define the apiKey in header? Is this more secure than apiKey? Commented Jun 4, 2020 at 9:48
  • 1
    @TranvuXuannhat. API Key is not secure, it's a simple string that never rotate. If it is stolen, the attacker have unlimited time for using it. It's better to use OAuth2 token, with 1H of life duration by default, that reduce the duration of the potential attack. And no, using header instead of url API Key is not more secure. Except that most of time, logger trace the URL called and not trace the header. If you have APIKey in the header you will have no trace of it in the logs.. That's all! Commented Jun 4, 2020 at 13:03
  • 1
    Thanks. That is a good lesson for me an user of a lot apis with API key also. Commented Jun 5, 2020 at 3:56
2

API key is generally not secured.

For server-to-server communication, one of the way to make it secured is using HTTPS and IP whitelisting.

However, for (browser or mobile client)-to-server communication, we need to store API key in client and of course it will be exposed to people.

For secured client-server communication for Google Cloud Endpoints, please try adding authentication method like Firebase or Google ID.

2

I am finding that actually, it is possible (at least with Google API Gateway, I might try later to see how it goes with Cloud Endpoints).

Please note, the name to use for the header is:

'X-API-Key' (or 'x-api-key', it is not case sensitive).

It works fine for me like that.

2
  • Can you add a reference to documentation/spec where it's described?
    – Anton Krug
    Commented Dec 12, 2020 at 13:24
  • 1
    I just read it as part of the Swagger spec. (open-api now), here swagger.io/docs/specification/2-0/authentication/api-keys then tried it out and found that it works. I would feel more comfortable to see this behavior stated in GCP docs, though, so that one can rely that it is there to stay. Commented Dec 13, 2020 at 20:51
1

Yes, it is possible to specify the API key in the header.

Here is an excerpt from Google's documentation on API key definition limitations:

When specifying an API key in the security definitions object in your OpenAPI document, Endpoints requires one of the following schemes:

  • The name is key and the in is query
  • The name is api_key and the in is query
  • The name is x-api-key and the in is header

Refer this link for more information and examples: https://cloud.google.com/endpoints/docs/openapi/openapi-limitations

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.