API 密钥是一个简单的字符串，用于标识Google Cloud 项目，以实现配额、结算和监控的目的。开发者在 Google Cloud 控制台中为项目生成一个 API 密钥，并将该密钥作为查询参数嵌入到对 API 的每次调用中或嵌入到请求标头中。
如果您在 API 配置中指定 API 密钥要求，API Gateway 会使用 API 密钥来查找关联的 Google Cloud 项目。除非 API 密钥是在您的 Google Cloud 项目或已启用 API 的其他Google Cloud 项目中生成的，否则 API Gateway 将拒绝请求。
如需创建 API 密钥或查看项目中已有的 API 密钥，请依次前往 API 和服务 > 凭据页面。 Google Cloud
如需使用配额等 API Gateway 功能，您可以传入 API 密钥，以便 API Gateway 可以识别与客户端应用关联的 Google Cloud 项目。
关于 API Gateway 的 API 密钥身份验证
如果您使用 API 密钥进行身份验证，则必须先为您的服务启用 API 密钥支持。
输入以下命令：
gcloud services enable MANAGED_SERVICE_NAME
MANAGED_SERVICE_NAME 指定您在部署 API 时创建的代管式服务的名称。您可以在控制台的 API 着陆页上的 API 的“托管式服务”列中找到此名称。或者，您也可以在使用 gcloud api-gateway apis describe 命令时在 Managed service 属性中找到此名称。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[[["\u003cp\u003eAPI keys are simple strings used to identify a Google Cloud project for quota, billing, and monitoring in API Gateway.\u003c/p\u003e\n"],["\u003cp\u003eAPI Gateway requires API keys generated within your Google Cloud project, or projects where your API is enabled, to authorize requests.\u003c/p\u003e\n"],["\u003cp\u003eWhile useful for features like quotas, API keys are vulnerable to man-in-the-middle attacks and should not be the sole form of authentication for sensitive data.\u003c/p\u003e\n"],["\u003cp\u003eEnabling API key support for a service requires using the \u003ccode\u003egcloud services enable MANAGED_SERVICE_NAME\u003c/code\u003e command, specifying the managed service's name.\u003c/p\u003e\n"],["\u003cp\u003eFor security, API keys should be restricted to specific APIs through the Google Cloud console's \u003cstrong\u003eAPIs & Services > Credentials\u003c/strong\u003e page, ensuring they are not used by unauthorized parties.\u003c/p\u003e\n"]]],[],null,["# Using API Keys\n==============\n\nThis page describes how to utilize API keys in API Gateway.\n\nAn API key is a simple string that identifies a\nGoogle Cloud project for quota, billing, and monitoring purposes. A\ndeveloper generates an API key in a project in the Google Cloud console and\nembeds that key in every call to your API as a query parameter or in a request header.\n\nIf you specify an API key requirement in your API config,\nAPI Gateway uses the API key to look up the associated Google Cloud project. API Gateway rejects requests unless\nthe API key was generated in your Google Cloud project or within other\nGoogle Cloud projects in which your API has been enabled.\n| **Note:** Unlike credentials that use short-lived tokens or signed requests, API keys function as part of the API request. As a result, API keys are vulnerable to [man-in-the-middle attacks](https://wikipedia.org/wiki/Man-in-the-middle_attack) and may not be as secure as other authentication credentials. You can use API keys in addition to one of the other [supported forms of authentication](/api-gateway/docs/authentication-method), but we do not recommend using *only* API keys when API calls contain sensitive data.\n\nTo create an API key, or view API keys already available within your Google Cloud project, go to the **APIs \\& Services** \\\u003e **Credentials** page.\n\n[Go to Credentials](https://console.cloud.google.com/apis/credentials)\n\n\u003cbr /\u003e\n\n### Use case\n\nTo use API Gateway features such as\n[quotas](/api-gateway/docs/quotas-overview), you can pass in an API\nkey so that API Gateway can identify the Google Cloud project\nthat the client application is associated with.\n\n### About API key authentication for API Gateway\n\nIf you are using an API key for authentication, you must first enable API key support\nfor your service.\n\nEnter the following command: \n\n```\ngcloud services enable MANAGED_SERVICE_NAME\n```\n\n\u003cbr /\u003e\n\nThe \u003cvar translate=\"no\"\u003eMANAGED_SERVICE_NAME\u003c/var\u003e specifies the name of the managed service created when you deployed the API. You can find this name in the Managed Service column for your API on the APIs landing page in the console. Alternatively, you can find this name in the `Managed service` property when using the `gcloud api-gateway apis describe` command.\n\nFor example: \n\n```\ngcloud services enable my-api-a12bcd345e67f89g0h.apigateway.my-project.cloud.goog\n```\n\n### Restricting API keys\n\nAPI keys are unrestricted by default. Unrestricted keys are insecure because\nthey can be used by anyone from anywhere. We recommend that you add *API restrictions* where possible.\nAPI restrictions specify which APIs can be called using the API key. All API keys used by production applications should have API restrictions.\n\nTo add API restrictions:\n\n1. Find the title of the API as noted in your API Config. In the following example, the API title is `My Example Config`:\n\n ```yaml\n # openapi.yaml\n swagger: '2.0'\n info:\n title: My Example Config\n description: Sample API on API Gateway\n version: 1.0.0\n ...\n ```\n2. In the Google Cloud console, go to the **APIs \\& Services** \\\u003e **Credentials** page.\n\n [Go to Credentials](https://console.cloud.google.com/apis/credentials)\n\n \u003cbr /\u003e\n\n3. Select the name of the API key you wish to use for your API.\n\n4. In the **API restrictions** section of the API key detail page, click **Restrict key**.\n\n5. Select the API that your API key will be used to access from the dropdown list of available APIs. For example, if\n using the example config above, select `My Example Config`.\n\n6. Click **Save**.\n\nYour restriction should take effect momentarily."]]
