Skip to main content

API Key Authentication

FastGateway supports API key authentication. Clients send their key in an HTTP header (default x-api-key).

General Mode​

In General (Recommended) mode, API key auth checks keys stored in a Kubernetes Secret. You never type the keys into FastGateway. You create the Secret yourself and reference it by name.

  1. Create a Kubernetes Secret in the fastgateway-system namespace that holds your valid keys. Each entry in the Secret is a valid key.
  2. In the route builder, open the Security tab and keep General mode.
  3. Expand API Key Authentication and check Enable API Key Authentication.
  4. Set K8s Secret Name to the name of the Secret you created.
  5. Set Header Name to the header clients send the key in. The default is x-api-key.
  6. Submit the route for approval. Once approved, the change deploys.

Requests must include the configured header, for example:

curl -H "x-api-key: your-secret-api-key" https://api.example.com/endpoint

Client Mode​

In Client-Based mode, each client has its own API key. Multiple clients can access the same route with different keys. A client's key is generated by FastGateway (prefix fg_live_) and shown only once. It is never typed in. See Client Management for generating and rotating client keys, then attach the client to the route with the API Key security feature enabled.

Best Practices​

PracticeDescription
Rotate regularlyChange API keys periodically
Use strong keysGenerate cryptographically secure keys
Separate environmentsUse different keys for dev/staging/prod
Monitor usageTrack API key usage for anomalies

Mode Selection​

  • Use General mode for internal services or simple authentication.
  • Use Client mode when multiple consumers need individual keys for tracking and revocation.

The REST API equivalent is documented in the API Reference.