What is the VerifyAPIKey policy and how does basic API key security work in Apigee?

The VerifyAPIKey policy is Apigee's most fundamental security mechanism. It validates that an incoming request contains a valid API key that was issued by Apigee to a registered developer application. If the key is absent or invalid, Apigee immediately returns a 401 Unauthorized response and the request never reaches the backend.

How the API key lifecycle works:

1. An API producer creates an API Product that bundles one or more API proxies
2. A developer registers on the developer portal and creates an App that subscribes to the product
3. Apigee generates a consumer key (the API key) for that app
4. The developer includes the key in each API request (typically as a header or query parameter)
5. The VerifyAPIKey policy validates the key against Apigee's registry on every request

<!-- Policy definition -->
<VerifyAPIKey name="VerifyAPIKey">
  <!-- Read the key from the x-api-key request header -->
  <APIKey ref="request.header.x-api-key"/>
</VerifyAPIKey>

<!-- Alternative: read from query parameter -->
<VerifyAPIKey name="VerifyAPIKey-QP">
  <APIKey ref="request.queryparam.apikey"/>
</VerifyAPIKey>

<!-- Placement: always in ProxyEndpoint PreFlow so every request is checked -->
<ProxyEndpoint name="default">
  <PreFlow name="PreFlow">
    <Request>
      <Step><Name>VerifyAPIKey</Name></Step>  <!-- Must run first -->
    </Request>
  </PreFlow>
</ProxyEndpoint>

<!-- After verification, Apigee populates flow variables:
  verifyapikey.VerifyAPIKey.client_id       -- the app consumer key
  verifyapikey.VerifyAPIKey.developer.email
  verifyapikey.VerifyAPIKey.app.name
  verifyapikey.VerifyAPIKey.api_product.name -->

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.