Using an API key in Amazon API Gateway

Question

I have created an API Key and added it to my functions. I have then deployed the api and tested it but still get:

"message": "Forbidden"

How do I pass the api key with my JSON request as I have been using "x-api-key": "theKey"?

this [post](http://www.awslessons.com/2017/aws-api-gateway-adding-apikey-requests/) explained it for me! — phouse512, Feb 26 '17 at 04:48

matsev · Accepted Answer · 2019-05-02T11:17:28.437

140

The x-api-key parameter is passed as a HTTP header parameter (i.e. it is not added to the JSON body). How you pass HTTP headers depend on the HTTP client you use.

For example, if you use curl and assuming that you POST the JSON payload, a request would look something like (where you replace [api-id] with the actual id and [region] with the AWS region of your API):

$ curl -X POST -H "x-api-key: theKey" -H "Content-Type: application/json" -d '{"key":"val"}' https://[api-id].execute-api.[region].amazonaws.com

edited May 02 '19 at 11:17

answered Aug 21 '16 at 20:13

matsev

32,104
16
121
156

Yes I use NSMutableURLRequest *request in ios sdk which then you can add the key too and it worked – cdub Aug 22 '16 at 01:57
2

Is there a way to use our own custom header name instead of "x-api-key" header name? – Manik Arora May 26 '21 at 06:34
4

Still relevant in 2021 - you would think the AWS docs would be a bit more specific on how (for example in Postman) you can provide your API key to test this functionality – bownie Sep 07 '21 at 10:39

score 122 · Answer 2 · answered Sep 07 '16 at 08:40

122

I had to add an API Usage plan, and then link the plan to the API stage.

Seems like this is the only way to link the key to the API, not sure if this is a recent change on AWS.

answered Sep 07 '16 at 08:40

TimoSolo

7,068
5
34
50

27

I just ran into the same issue. Took me half an hour to figure out what's going on. This lousy error message: `{"message":"Forbidden"}` wasn't helpful at all. Thanks AWS!! – kev Nov 09 '17 at 01:11
15

Classic AWS. Just miss out a vital part of the documentation and don't tell you what the problem is in the error message or how to fix it. Thanks, this solved it for me. – Rich Smith Feb 15 '18 at 10:53
This helped me. – Shamal Karunarathne Jun 22 '18 at 15:58
8

don't forget to deploy again! – AlleyOOP Dec 08 '19 at 19:45
5

The way I found the solution was to activate logging. That needs a Role for apigateway with the permission AmazonAPIGatewayPushToCloudWatchLogs. In the logging, the message is actually very clear: "API Key ***** not authorized because method 'POST /predict' requires API Key and API Key is not associated with a Usage Plan for API Stage x______y/stg: No Usage Plan found for key and API Stage" – peter_v Jan 22 '20 at 16:30
Is there a way to use our own custom header name instead of "x-api-key" header name? – Manik Arora May 26 '21 at 06:35
so circumvoluted – Kaymaz May 12 '22 at 19:58

score 48 · Answer 3 · edited Apr 21 '17 at 04:21

48

If you set 'API Key Required' option to true, please check below.

you have to pass 'x-api-key' HTTP Header Parameter to API Gateway.
The API Key had to be created.
In addition, you need to check a Usage Plan for the API Key on API Gateway Console.

edited Apr 21 '17 at 04:21

Pang

9,564
146
81
122

answered Apr 21 '17 at 04:13

Daniel Jihoon Oh

1,809
1
10
4

2

Thanks. I think aws documentation is far from clear to mention this. – Víctor Hugo Jan 03 '18 at 16:55
5

It didn't work for me until I created a Usage Plan. This should not be necessary I guess. Thanks! – Andres Feb 20 '19 at 20:44

bisw · Answer 4 · 2018-06-29T12:01:38.700

41

If you set 'API' key required to true, you need to pass the api key as header.

API Key is passed as header field 'x-api-key'. Even after adding this field in header, this issue may occur. In that case, please validate below points

Do you have a Usage Plan? if not need to create one.
Link you API with Usage Plan. For that add a stage, it will link your API
Do you have API Key? if not you need to create an API Key and enable it.
Add the Usage Plan which is linked with your API to this API Key. For that, add Usage Plan.

edited Jun 29 '18 at 12:01

answered Jun 29 '18 at 11:04

bisw

827
9
13

Great notes. Thanks. – user1965074 Aug 30 '20 at 13:41
Will it not work if I don't set a stage for apiKey usage plan? – kittu Jun 06 '22 at 08:33

score 25 · Answer 5 · answered Aug 21 '16 at 11:23

25

I hope you are not missing to link the API key with the API

answered Aug 21 '16 at 11:23

Partha

814
6
13

score 16 · Answer 6 · answered Jun 17 '19 at 15:31

I was able to get a successful response from Lambda using below configuration in Postman native app -

Under authorization tab (For some reason this didn't work when i passed the same parameters under header)

Key : x-api-key

Value : your-api-key-value

Add to : Header

score 6 · Answer 7 · answered Sep 15 '21 at 20:17

I don't have enough reputation to set this as a comment, But I was finally able to find the document specifying that 'x-api-key' belongs in the header for API Gateway calls that come from outside clients (like postman, swagger, etc.) in the AWS Documentation.

The relevant part:

To use header-sourced API keys:

Create an API with desired API methods. And deploy the API to a stage.

Create a new usage plan or choose an existing one. Add the deployed API stage to the usage plan. Attach an API key to the usage plan or choose an existing API key in the plan. Note the chosen API key value.

Set up API methods to require an API key.

Redeploy the API to the same stage. If you deploy the API to a new stage, make sure to update the usage plan to attach the new API stage.

The client can now call the API methods while supplying the x-api-key header with the chosen API key as the header value.

Choose an API key source

I was looking exactly for the key name, thanks – prhmma Mar 16 '22 at 22:14 — prhmma, Mar 16 '22 at 22:14

score 5 · Answer 8 · answered May 30 '19 at 16:31

5

For Private API Gateways accessed through public DNS, we need to pass additional header of 'x-apigw-api-id' with the api id along with 'x-api-key' if configured.

curl -v https://{vpce-id}.execute-api.{region}.vpce.amazonaws.com/test -H 'x-apigw-api-id:{api-id}'

Its documented below,

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html#w20aac13c16c28c11

answered May 30 '19 at 16:31

msounthar

343
4
8

My issue was that I had included this x-apigw-api-id header for a public API Gateway by mistake. Removing it worked for me. – Skromak Feb 18 '21 at 14:01

Mike Bendorf · Answer 9 · 2022-05-01T17:54:47.670

3

Here a good resource explaining different reasons why we could be getting a Forbidden. The two most important are the request URL and the x-api-key header:

https://{api_id}.execute-api.{region}.amazonaws.com/{stage_name}/{resource_name}

Missing stage name will give you 403 for ex. Maybe for security reasons the response is not revealing an issue with the stage name, and thus you get a generic Forbidden.

edited May 01 '22 at 17:54

answered May 01 '22 at 17:48

Mike Bendorf

460
6
7

score 2 · Answer 10 · answered Aug 20 '22 at 03:38

I faced the same problem today. I had already mapped the API key to the usage plan (which was linked to the api gateway stage). I was also passing the api key in header correctly.

When none of these solutions work, do remember to check if your API is linked to WAF policy with only a certain ip-addresses permitted. Apparently, my IP address had changed today. So, WAF was blocking me. That can be an additional reason to get {"message": "Forbidden"} error.

score 1 · Answer 11 · answered Apr 20 '23 at 12:09

1

I had the same issue today, but my problem was that I forgot to associate a usage plan with a stage.

Usage Plan -> Details -> Add Stage

answered Apr 20 '23 at 12:09

Pythoner

460
6
23

score 0 · Answer 12 · answered Aug 11 '23 at 15:41

0

A source of error can be the global setting for "Api Key Source".

In the console, when inside the API, navigate to "Settings" > Scroll down to "API Key Source" > Select "HEADER".

answered Aug 11 '23 at 15:41

Finch_Powers

2,938
1
24
34

Using an API key in Amazon API Gateway

12 Answers12

Linked