# API Key Authentication

> Configure API key authentication for your routes

FastGateway supports API key authentication. Clients send their key in an HTTP header (default `x-api-key`).

## General Mode

In **General (Recommended)** mode, API key auth checks keys stored in a Kubernetes Secret. You never type the keys into FastGateway. You create the Secret yourself and reference it by name.

1. Create a Kubernetes Secret in the `fastgateway-system` namespace that holds your valid keys. Each entry in the Secret is a valid key.
2. In the route builder, open the **Security** tab and keep **General** mode.
3. Expand **API Key Authentication** and check **Enable API Key Authentication**.
4. Set **K8s Secret Name** to the name of the Secret you created.
5. Set **Header Name** to the header clients send the key in. The default is `x-api-key`.
6. Submit the route for approval. Once approved, the change deploys.

Requests must include the configured header, for example:

```bash
curl -H "x-api-key: your-secret-api-key" https://api.example.com/endpoint
```

## Client Mode

In **Client-Based** mode, each client has its own API key. Multiple clients can access the same route with different keys. A client's key is generated by FastGateway (prefix `fg_live_`) and shown only once. It is never typed in. See [Client Management](./client-management.md) for generating and rotating client keys, then attach the client to the route with the **API Key** security feature enabled.

## Best Practices

| Practice | Description |
|----------|-------------|
| **Rotate regularly** | Change API keys periodically |
| **Use strong keys** | Generate cryptographically secure keys |
| **Separate environments** | Use different keys for dev/staging/prod |
| **Monitor usage** | Track API key usage for anomalies |

## Mode Selection

- Use **General mode** for internal services or simple authentication.
- Use **Client mode** when multiple consumers need individual keys for tracking and revocation.

The REST API equivalent is documented in the [API Reference](/docs/reference/api-reference).