API / APIGEE Gateway Interview Questions
What is the VerifyAPIKey policy and how does basic API key security work in Apigee?
The VerifyAPIKey policy is Apigee's most fundamental security mechanism. It validates that an incoming request contains a valid API key that was issued by Apigee to a registered developer application. If the key is absent or invalid, Apigee immediately returns a 401 Unauthorized response and the request never reaches the backend.
How the API key lifecycle works:
- An API producer creates an API Product that bundles one or more API proxies
- A developer registers on the developer portal and creates an App that subscribes to the product
- Apigee generates a consumer key (the API key) for that app
- The developer includes the key in each API request (typically as a header or query parameter)
- The VerifyAPIKey policy validates the key against Apigee's registry on every request
<!-- Policy definition --> <VerifyAPIKey name="VerifyAPIKey"> <!-- Read the key from the x-api-key request header --> <APIKey ref="request.header.x-api-key"/> </VerifyAPIKey> <!-- Alternative: read from query parameter --> <VerifyAPIKey name="VerifyAPIKey-QP"> <APIKey ref="request.queryparam.apikey"/> </VerifyAPIKey> <!-- Placement: always in ProxyEndpoint PreFlow so every request is checked --> <ProxyEndpoint name="default"> <PreFlow name="PreFlow"> <Request> <Step><Name>VerifyAPIKey</Name></Step> <!-- Must run first --> </Request> </PreFlow> </ProxyEndpoint> <!-- After verification, Apigee populates flow variables: verifyapikey.VerifyAPIKey.client_id -- the app consumer key verifyapikey.VerifyAPIKey.developer.email verifyapikey.VerifyAPIKey.app.name verifyapikey.VerifyAPIKey.api_product.name -->
What HTTP status code does Apigee return when the VerifyAPIKey policy fails because the key is invalid?
After a successful VerifyAPIKey policy execution, what data becomes available in Apigee flow variables?
More Related questions...
