For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Enable API key credential management in the Portal frontend app so that your users can self-service API keys to access Portal APIs.

You can protect an API product route with API keys. This way, access to the API is denied by default. Portal users must present a valid API key in their request to be successfully authenticated and be able to work with that API.

While you can manage API keys yourself, the Portal frontend app has a built-in capability that allows you to enable API key self-service for Portal users. Once enabled, Portal users can log in to the Portal and create their own API keys to access an API product that they are subscribed to.

The following diagram illustrates how portal users create an API key and use it to access an API.

    %%{init: {"theme": "base", "themeVariables": {"primaryColor": "#cce5ff", "primaryBorderColor": "#3399ff", "primaryTextColor": "#003366", "lineColor": "#3399ff", "edgeLabelBackground": "#e8f4ff", "secondaryColor": "#e8f4ff", "tertiaryColor": "#ffffff", "noteBkgColor": "#e8f4ff", "noteTextColor": "#003366"}}}%%
sequenceDiagram
    actor User as Portal user
    participant Portal as Portal frontend
    participant Gateway as Portal gateway
    participant App as App

    Note over User,Portal: Create API key
    User->>Portal: Create API key for App
    Portal-->>User: Show API key (one time only)

    Note over User,App: Call API
    User->>Gateway: GET /headers <br/>(api-key: YOUR_API_KEY)
    Gateway->>Portal: Check API key + subscription (portalAuth)
    Portal-->>Gateway: Approved
    Gateway->>App: Forward request
    App-->>Gateway: Response
    Gateway-->>User: 200 OK
  

Before you begin

Portal admins must complete the following tasks:

1. Set up a portal web server.
2. Secure the login to the portal frontend.
3. Optional: Set up a backing database for your portal. This database is used to store the API keys that your users create in the Portal frontend app.

Secure a Portal API with API keys

You can enable API key management in the Portal frontend app by creating an AuthConfig and associating it with an API product route.

1. Create an AuthConfig to enable API key auth for the httpbin API. This AuthConfig leverages the portalAuth capability that automatically stores API keys that Portal users create through the portal frontend in the Portal backing database.

   kubectl apply -f- <<EOF                               
   apiVersion: extauth.solo.io/v1
   kind: AuthConfig
   metadata:
     name: httpbin-auth
     namespace: default
   spec:
     configs:
       - name: httpbinAuth
         portalAuth:
           url: http://portal-my-portal.default.svc.cluster.local:8080
           cacheDuration: 10s
           apiKeyHeader: "api-key"
   EOF

2. Create an EnterpriseKgatewayTrafficPolicy that references the AuthConfig and applies the config to httpbin’s HTTPRoute. You also include a CORS policy that allows requests from a different origin to the httpbin API in the portal frontend.

   kubectl apply -f- <<EOF   
   apiVersion: enterprisekgateway.solo.io/v1alpha1
   kind: EnterpriseKgatewayTrafficPolicy
   metadata:
     name: httpbin-auth
     namespace: default
   spec:
     targetRefs:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       name: httpbin-route
     entExtAuth:
       authConfigRef:
         name: httpbin-auth
         namespace: default
     cors:
       allowCredentials: true
       allowHeaders:
         - "*"
       allowMethods:
         - GET
       allowOrigins:
         - "*"
   EOF

3. Test that the httpbin app is protected.

   curl -vik localhost:8080/httpbin/headers -H "host: api.example.com"

   Example output:

   * Request completely sent off
   < HTTP/1.1 403 Forbidden
   HTTP/1.1 403 Forbidden
   < server: envoy
   server: envoy
   < content-length: 0
   content-length: 0
   < 
   
   * Connection #0 to host localhost left intact

Next

Now that you enabled API key credential management in the frontend app, Portal users can self-service their own API keys in the frontend app to access Portal APIs.