SPEAKER: If you've been following along in this series,
you have a basic API proxy with a few policies.
Now, we want to add a simple security control--
checking for a valid API key.
In this video, we will show you how
to add a verify API key policy to your proxy
to check an API key.
We'll learn about context variables in the Apigee API
proxy.
And we'll also see how to use the Apigee Debug
Tool to observe the operation of the API proxy.
Let's get going.
[MUSIC PLAYING]
In the Apigee UI, navigate to your proxy.
Select the Develop tab to modify the proxy.
Find the proxy PreFlow.
In the Request flow, again, click the plus icon
to add a policy.
This time, we'll select the Verify API Key policy, clicking
on the resulting link, and there is
the pre-populated configuration for the newly added policy.
We can configure the policy to find the API
key in the inbound request.
We'll use a reference to what is known as a context variable.
In an Apigee API proxy, there is a context for each request.
And within that context, there are variables that carry state.
The state might be the verb or the path used
in the inbound request or the values of query parameters
are headers or the message payload.
Context variables can also hold the results
of policy execution, for example, the remaining
requests in a rate limit for the results of a cache lookup.
With this configuration, I'm referring to a variable
to have the policy retrieve the API key from a query parameter.
Let me save those changes and deploy
the new revision of the proxy.
While that's saving, I want to show
you the reference documentation on context variables.
Just search for variable reference
Apigee to read more about the available pre-populated context
variables.
You can access any of these in your various policies or flows
inside an API proxy.
OK, we've modified the proxy to check for an API key.
Where do we get a valid API key?
For that, we need a registered developer app.
Before we get the app, we need a developer and an API product.
So let's create those entities now.
We'll do that through the panels available in the Publish
section of the navigation bar in the Apigee UI.
First, the developer.
This is a registered consumer developer,
someone who will own application credentials.
We'll just create an example account here.
Now, the API product.
This is the packaging of the API proxy.
We'll select the proxy and add all GET operations
on that proxy.
And we need to save it.
And finally, let's create an app.
An app is owned by a developer and is authorized for use
with a particular API product.
The app holds credentials-- the API key.
Apigee generates a random key automatically.
Let me copy the API key from this panel.
Now, I'll flip to the browser tab to invoke the proxy again.
You can see when I refresh, I'm seeing an error message.
That's because I haven't passed a valid API key.
But adding the API key query parameter with the right value,
if I invoke the proxy again, it allows the call to succeed.
Back into the Apigee API, let's use the Debug tool
to observe the activities of all the policies in this proxy.
When I start the bug session, Apigee automatically
will begin collecting information
for all the requests flowing into an API proxy,
and it will display that information
on the browser page.
Let me start that.
And let me make a new request now.
With this, I can observe the API proxy behavior
and understand what the client is sending in, how each Apigee
policy is acting, the context variables
that get set and read, and what Apigee sends back.
This is an invaluable tool for inspecting API proxy activity.
It also gives me a timeline of execution
for the entire request and response flow, really nice.
When you have a proxy that is behaving not quite as you
expect, the Debug tool is super helpful in showing
you what's going on.
Let's wrap up.
In this video, you learned about API key verification
and the relationship of keys to apps, developers, and products.
You also saw the Debug tool, which
lets you understand what the API proxy is doing at runtime.
In the next video, I'll cover how
to publish your API products to a developer portal
and allow developers to self-register.
Don't forget to like and subscribe.
[MUSIC PLAYING]