您可以通过附加 VerifyAPIKey 政策，为 API 设置 API 密钥验证。VerifyAPIKey 政策所需的唯一设置是客户端请求中 API 密钥的预期位置。API 代理将检查您指定的位置，并提取 API 密钥。如果 API 密钥不在预期位置，系统将抛出错误并拒绝请求。API 密钥可以位于查询参数、表单参数或 HTTP 标头中。
例如，以下政策配置会将预期密钥位置定义为名为 apikey 的查询参数。成功的请求必须将 API 密钥作为查询参数附加到请求中，例如 ?apikey=Y7yeiuhcbKJHD790。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[[["\u003cp\u003eThis guide outlines how to implement API key validation for APIs in Apigee and Apigee hybrid, using the Verify API Key policy to check for the key's presence in client requests.\u003c/p\u003e\n"],["\u003cp\u003eThe Verify API Key policy requires specification of the API key's location, which can be a query parameter, form parameter, or HTTP header, and the example provided uses a query parameter named "apikey".\u003c/p\u003e\n"],["\u003cp\u003eAfter successful API key verification, it's recommended to remove the API key from the request message using the AssignMessage policy to prevent it from being transmitted to the backend service.\u003c/p\u003e\n"],["\u003cp\u003eAttaching the VerifyAPIKey and AssignMessage policies to the API proxy's PreFlow ensures that API key validation and subsequent removal are performed on every incoming request.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys can be retrieved by administrators for any app using a specific curl command, which allows for validating access and ensuring correct key usage in client requests.\u003c/p\u003e\n"]]],[],null,["# Setting up API key validation\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nYou can set up API key validation for an API by attaching a policy of type Verify API Key. The\nonly required setting for a [VerifyAPIKey policy](/apigee/docs/api-platform/reference/policies/verify-api-key-policy) is the expected location of the API key in the\nclient request. The API proxy will check the location that you specify, and extract the API key.\nIf the API key is not present in the expected location, then an error is thrown and the request\nis rejected. API keys can be located in a query parameter, a form parameter, or an HTTP\nheader.\n\nFor example, the policy configuration below defines the expected key location as a query\nparameter named `apikey`. A successful request must present the API key as a query\nparameter appended to the request, for example,`?apikey=Y7yeiuhcbKJHD790`.\n\nTo verify API keys, create the following policy: \n\n```text\n\u003cVerifyAPIKey name=\"APIKeyValidation\"\u003e\n \u003cAPIKey ref=\"request.queryparam.apikey\"/\u003e\n\u003c/VerifyAPIKey\u003e\n```\n\nThis policy can be attached to any API that you need to protect.\n\nComprehensive documentation of this policy type can be found in the policy reference topic,\n[VerifyAPIKey policy](/apigee/docs/api-platform/reference/policies/verify-api-key-policy).\n\nAPI proxies automatically pass through all HTTP headers and query parameters that are present\non the request. Therefore, after the API key has been verified, it's a good idea to strip it from\nthe message so that the API key is not sent over the wire to the backend service. You can do that\nusing a policy of type `AssignMessage` as follows: \n\n```carbon\n\u003cAssignMessage name=\"StripApiKey\"\u003e\n \u003cDisplayName\u003eRemove Query Param\u003c/DisplayName\u003e\n \u003cRemove\u003e\n \u003cQueryParams\u003e\n \u003cQueryParam name=\"apikey\"/\u003e\n \u003c/QueryParams\u003e\n \u003c/Remove\u003e\n \u003cIgnoreUnresolvedVariables\u003etrue\u003c/IgnoreUnresolvedVariables\u003e\n \u003cAssignTo createNew=\"false\" transport=\"http\" type=\"request\"\u003e\u003c/AssignTo\u003e\n\u003c/AssignMessage\u003e\n```\n\nPolicy attachment\n-----------------\n\nThe policies must be attached to an API proxy Flow as processing Steps. By applying the policy\nto the request `PreFlow`, API keys are verified on every request received by the API proxy from a\nclient app. After verification, the API key is stripped from the outbound request.\n\nAttach the policies to the ProxyEndpoint of the API proxy to be protected as follows: \n\n```ecl\n\u003cProxyEndpoint name=\"default\"\u003e\n \u003cPreFlow\u003e\n \u003cRequest\u003e\n \u003cStep\u003e\u003cName\u003eAPIKeyValidation\u003c/Name\u003e\u003c/Step\u003e\n \u003cStep\u003e\u003cName\u003eStripApiKey\u003c/Name\u003e\u003c/Step\u003e\n \u003c/Request\u003e\n \u003c/PreFlow\u003e\n```\n\nAfter you attach the policy, deploy the API proxy.\n\nSubmitting a request with a valid API key\n-----------------------------------------\n\nAs an admin in your organization, you can retrieve any app's API key as follows: \n\n```\ncurl \"https://apigee.googleapis.com/v1/organizations/$ORG/developers/$DEVELOPER_EMAIL/apps/$APP \\\n -H \"Authorization: Bearer $TOKEN\"\n```\n\nWhere `$TOKEN` is set to your OAuth 2.0 access token, as described in\n[Obtaining an OAuth 2.0 access token](/apigee/docs/api-platform/get-started/api-get-started#oauth20). For information about the `curl` options used in this example, see\n[Using curl](/apigee/docs/api-platform/get-started/api-get-started#curl). For a description of environment variables you can use, see\n[Setting\nenvironment variables for Apigee API requests](/apigee/docs/api-platform/get-started/api-get-started#api-environment-variables).\n\nThe app profile that is returned for this call provides the consumer key (API key) and secret.\nThe consumer key value is the value you use for the API key in your request to the protected\nAPI.\n\nFor example, a request that does not include an API key results in an authorization\nfailure. \n\n```\ncurl http://apitest.examplepetstore.com/weather/forecastrss?w=12797282\n```\n\nThe failure message indicates that the policy checked for an API key but did not find a valid\nkey: \n\n```gdscript\nOAuth Failure : Could not resolve the app key with variable request.queryparam.apikey\n```\n\nWhen the consumer key for the app is included as a query parameter, the expected result is\nsuccessful authorization: \n\n```\ncurl http://apitest.examplepetstore.com/weather/forecastrss?w=12797282&\"apikey=PulSCqMnXGchW0pC0s5o9ngHVTWMeLqk\"\n```\n\nThe expected result is a successful response from the weather service.\n\nModifying the value of the API key value in the request results in an authorization\nfailure: \n\n```\ncurl http://apitest.examplepetstore.com/weather?forecastrss?w=12797282&\"apikey=PulSCqMnXGchW0\"\n```\n\nResults in: \n\n```text\nOAuth Failure : Consumer Key is Invalid\n```"]]
