SPEAKER: It's important to protect
your API from unauthorized access, and one way to do this
is with API keys.
And so in this episode, we will cover
how to create an API proxy that requires an API key,
and then also how to create an API product,
how to add a developer, how to register an app
and then call your API with an API key.
[MUSIC PLAYING]
When an app makes a request to an API proxy that
is configured to verify an API key,
the app must supply a valid key.
At runtime, the Verify API Key policy
checks that the supplied API key is,
one, valid, hasn't been revoked, and matches the API
key for the API product that exposes
the requested resources.
If the key is valid, the request is allowed.
If the key is invalid, the request
results in an authorization failure.
So let's first start off by creating a proxy.
Visit apigee.google.com.
Next, click Develop, API Proxies, Create New.
This is the Build a Proxy wizard.
Select Reverse Proxy, which is the most common, FYI.
Enter the following values like this.
Click Next.
On the Common Policies page, select API Key.
This option automatically adds two policies to your API proxy.
Click Next.
On the Summary page, select the Optional Deployment checkbox
for your environment.
Next, click Create and Deploy.
And finally, select Edit Proxy to view
the overview of the API proxy.
From here, you can view the deployment status, which takes
a few seconds to complete.
To view the policies that were added by the wizard,
let's select the Develop tab.
You'll see that two policies have
been added to the proxy request proof flow of the API proxy.
One is Verify API Key, which checks
the API call to make sure a valid API is present,
sent as a parameter.
The second is a Remove Query Param API
Key, which is an assigned message policy that
removes the API key after it's checked so that it doesn't
get exposed unnecessarily.
Click the Verify API Key Policy icon in the flow view
and look at the policy's XML configuration in the lower code
view.
The API Key element tells the policy
where it should look for the API key when the call is made.
By default, it looks for the key as a query parameter called
APIKey in the HTTP request.
The name APIKey is not special.
It can be any property that contains the API key.
Next, let's try to call the API.
First, lets directly access the target.
In a web browser, go to the following address--
mocktarget.apigee.net.
This is a target service the API proxy is configured
to forward requests to.
You should get this successful response, "hello guest."
Now let's make a call to the API proxy
to see how it's being protected by the policies.
We will make a curl command using
the external internet-facing host name.
If you do not have one set up, I have included instructions
in this video's description.
Note that in my case, the external IP
provided by the external load balancer
is configured with a DNS registered hostname.
We can call the API using curl and a command line terminal,
such as the Cloud Shell from your Google Cloud project
at console.google.com.
Because of the Verify API Key policy,
you get the following error response
since it did not pass a valid API key.
If we didn't configure that policy,
you would get the same successful response
we saw before.
Now close your Cloud terminal.
[? great, ?] so now let's get an API key.
First, we'll create an API product
by returning to the Apigee console and select Publish, API
Products.
And click on the +API Product.
Enter the product details for your API product.
First, an internal name--
and note you cannot use special characters.
And once created, you cannot change it later.
Next, enter the display name, which
can use special characters.
Or you can let it default to the name which is used in the UI,
and you can edit it at any time.
Next, add a description of your API product.
Then check the box to have it allow access
to your eval environment, and change the access
level to Public.
Also check the box to Automatically Approve Access
Requests.
You can leave Quota and the Allowed OAuth Scopes unfilled
for now.
Next, scroll down a bit to the API resources section and click
Plus, then select the API proxy you just created,
then click Add.
In the Path section, click Add a Path and enter a single slash.
Click Save.
Next we're going to simulate the workflow of a developer signing
up to use your APIs.
A developer will have one or more apps that call your APIs,
and each app gets a unique API key.
This gives you, the API provider, more granular control
over access to your APIs and more granular reporting
on API traffic by app.
So let's create a developer by selecting Publish,
Developers in the left menu, and click +Developer,
and enter the following in the New Developer window,
and click Create.
Now let's register an app by selecting Publish, Apps,
and click +App.
Enter the following data in the New Developer App window.
Click the Developer box to select
a developer you just created.
Then in the Credential section, ensure Never
is selected so that the credentials for this app
never expire.
Next, click Add product and select
the product you just created.
And finally, click Create.
Now let's get the API key by clicking Show in the Key field.
You can access this page later by going to Publish, Apps,
and selecting your app.
Notice that the key is associated with the product
you created.
Select and copy the key, which you
will paste as a query parameter using the documentation's
template, and ensure there are no extra spaces.
Next, open your Cloud terminal once again
and paste this curl document.
And now when you call the API proxy,
you will get "Hello, Guest" as a response.
Congratulations.
You've created an API proxy and protected it
by requiring that a valid API key be included in the call.
However, note it's a good practice
to pass the API key in a header rather
than in a query parameter.
The reason is because headers do not
appear in the browser history or network
logs, which could present a possible security risk.
And so I have linked instructions on how to do so.
And there you have it-- a quick walk-through
on how to protect your API from unauthorized access.
And friends, if you found this episode helpful,
you can click Like or subscribe to the channel.
Cheers.
[MUSIC PLAYING]