您可以附加「驗證 API 金鑰」類型的政策，為 API 設定 API 金鑰驗證。VerifyAPIKey 政策唯一必要的設定，就是用戶端要求中 API 金鑰的預期位置。API Proxy 會檢查您指定的位置，並擷取 API 金鑰。如果 API 金鑰不在預期位置，系統會擲回錯誤，並拒絕要求。API 金鑰可位於查詢參數、表單參數或 HTTP 標頭中。
例如，下列政策設定將預期的索引鍵位置定義為名為 apikey 的查詢參數。成功的要求必須將 API 金鑰做為查詢參數附加至要求，例如 ?apikey=Y7yeiuhcbKJHD790。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-18 (世界標準時間)。"],[[["\u003cp\u003eThis guide outlines how to implement API key validation for APIs in Apigee and Apigee hybrid, using the Verify API Key policy to check for the key's presence in client requests.\u003c/p\u003e\n"],["\u003cp\u003eThe Verify API Key policy requires specification of the API key's location, which can be a query parameter, form parameter, or HTTP header, and the example provided uses a query parameter named "apikey".\u003c/p\u003e\n"],["\u003cp\u003eAfter successful API key verification, it's recommended to remove the API key from the request message using the AssignMessage policy to prevent it from being transmitted to the backend service.\u003c/p\u003e\n"],["\u003cp\u003eAttaching the VerifyAPIKey and AssignMessage policies to the API proxy's PreFlow ensures that API key validation and subsequent removal are performed on every incoming request.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys can be retrieved by administrators for any app using a specific curl command, which allows for validating access and ensuring correct key usage in client requests.\u003c/p\u003e\n"]]],[],null,["# Setting up API key validation\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nYou can set up API key validation for an API by attaching a policy of type Verify API Key. The\nonly required setting for a [VerifyAPIKey policy](/apigee/docs/api-platform/reference/policies/verify-api-key-policy) is the expected location of the API key in the\nclient request. The API proxy will check the location that you specify, and extract the API key.\nIf the API key is not present in the expected location, then an error is thrown and the request\nis rejected. API keys can be located in a query parameter, a form parameter, or an HTTP\nheader.\n\nFor example, the policy configuration below defines the expected key location as a query\nparameter named `apikey`. A successful request must present the API key as a query\nparameter appended to the request, for example,`?apikey=Y7yeiuhcbKJHD790`.\n\nTo verify API keys, create the following policy: \n\n```text\n\u003cVerifyAPIKey name=\"APIKeyValidation\"\u003e\n \u003cAPIKey ref=\"request.queryparam.apikey\"/\u003e\n\u003c/VerifyAPIKey\u003e\n```\n\nThis policy can be attached to any API that you need to protect.\n\nComprehensive documentation of this policy type can be found in the policy reference topic,\n[VerifyAPIKey policy](/apigee/docs/api-platform/reference/policies/verify-api-key-policy).\n\nAPI proxies automatically pass through all HTTP headers and query parameters that are present\non the request. Therefore, after the API key has been verified, it's a good idea to strip it from\nthe message so that the API key is not sent over the wire to the backend service. You can do that\nusing a policy of type `AssignMessage` as follows: \n\n```carbon\n\u003cAssignMessage name=\"StripApiKey\"\u003e\n \u003cDisplayName\u003eRemove Query Param\u003c/DisplayName\u003e\n \u003cRemove\u003e\n \u003cQueryParams\u003e\n \u003cQueryParam name=\"apikey\"/\u003e\n \u003c/QueryParams\u003e\n \u003c/Remove\u003e\n \u003cIgnoreUnresolvedVariables\u003etrue\u003c/IgnoreUnresolvedVariables\u003e\n \u003cAssignTo createNew=\"false\" transport=\"http\" type=\"request\"\u003e\u003c/AssignTo\u003e\n\u003c/AssignMessage\u003e\n```\n\nPolicy attachment\n-----------------\n\nThe policies must be attached to an API proxy Flow as processing Steps. By applying the policy\nto the request `PreFlow`, API keys are verified on every request received by the API proxy from a\nclient app. After verification, the API key is stripped from the outbound request.\n\nAttach the policies to the ProxyEndpoint of the API proxy to be protected as follows: \n\n```ecl\n\u003cProxyEndpoint name=\"default\"\u003e\n \u003cPreFlow\u003e\n \u003cRequest\u003e\n \u003cStep\u003e\u003cName\u003eAPIKeyValidation\u003c/Name\u003e\u003c/Step\u003e\n \u003cStep\u003e\u003cName\u003eStripApiKey\u003c/Name\u003e\u003c/Step\u003e\n \u003c/Request\u003e\n \u003c/PreFlow\u003e\n```\n\nAfter you attach the policy, deploy the API proxy.\n\nSubmitting a request with a valid API key\n-----------------------------------------\n\nAs an admin in your organization, you can retrieve any app's API key as follows: \n\n```\ncurl \"https://apigee.googleapis.com/v1/organizations/$ORG/developers/$DEVELOPER_EMAIL/apps/$APP \\\n -H \"Authorization: Bearer $TOKEN\"\n```\n\nWhere `$TOKEN` is set to your OAuth 2.0 access token, as described in\n[Obtaining an OAuth 2.0 access token](/apigee/docs/api-platform/get-started/api-get-started#oauth20). For information about the `curl` options used in this example, see\n[Using curl](/apigee/docs/api-platform/get-started/api-get-started#curl). For a description of environment variables you can use, see\n[Setting\nenvironment variables for Apigee API requests](/apigee/docs/api-platform/get-started/api-get-started#api-environment-variables).\n\nThe app profile that is returned for this call provides the consumer key (API key) and secret.\nThe consumer key value is the value you use for the API key in your request to the protected\nAPI.\n\nFor example, a request that does not include an API key results in an authorization\nfailure. \n\n```\ncurl http://apitest.examplepetstore.com/weather/forecastrss?w=12797282\n```\n\nThe failure message indicates that the policy checked for an API key but did not find a valid\nkey: \n\n```gdscript\nOAuth Failure : Could not resolve the app key with variable request.queryparam.apikey\n```\n\nWhen the consumer key for the app is included as a query parameter, the expected result is\nsuccessful authorization: \n\n```\ncurl http://apitest.examplepetstore.com/weather/forecastrss?w=12797282&\"apikey=PulSCqMnXGchW0pC0s5o9ngHVTWMeLqk\"\n```\n\nThe expected result is a successful response from the weather service.\n\nModifying the value of the API key value in the request results in an authorization\nfailure: \n\n```\ncurl http://apitest.examplepetstore.com/weather?forecastrss?w=12797282&\"apikey=PulSCqMnXGchW0\"\n```\n\nResults in: \n\n```text\nOAuth Failure : Consumer Key is Invalid\n```"]]
