key-auth authentication for query param in url

[hexasubhash]

How to authenticate the apikey from the query param of url ? my URL is https://host/myservice/v1?apikey=key, have configured in plugins , consumer and as in route, stil am getting auth failed error.

[dosubot[bot]]

Hi @hexasubhash! I'm Dosu and I’m helping the apisix team.

The key-auth plugin should work with query parameters out of the box since apikey is the default query parameter name. Here are the most common causes for "auth failed" errors:

Most likely issue: key-auth configured in consumer_group

If you've placed the key-auth plugin configuration inside a consumer_group, that won't work. Authentication plugins must be configured directly on consumers, not in consumer_groups, due to how the execution sequence works.

Correct setup:

1. Consumer with API key:

curl "http://127.0.0.1:9180/apisix/admin/consumers" -X PUT -d '{  
  "username": "myuser",
  "plugins": {
    "key-auth": {
      "key": "key"
    }
  }
}'

2. Route with key-auth enabled:

curl "http://127.0.0.1:9180/apisix/admin/routes/1" -X PUT -d '{
  "uri": "/myservice/v1",
  "plugins": {
    "key-auth": {}
  },
  "upstream": { ... }
}'

3. Test: curl "http://host/myservice/v1?apikey=key"

Could you share your consumer and route configurations? That would help identify the specific issue.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[HNJAMeindersma]

You'll want to use this config inside the plugins list:

"key-auth": {
    "query": "apikey"
}

If you also for example use the serverless-pre-function plugin, you might want to configure it to run in a later phase, like access instead of rewrite. This would be required if you use this function to sanitize your incoming query parameters.