Step 3 - API Key Authentication

Link your Local Project

When developing locally with Zuplo, you can "link" your local project to your Zuplo project using the zuplo link command. This allows you to test your changes in a real environment.

When you run the command you will be prompted to select your Zuplo account, project, and environment. You can pick any environment.

Code
 
npx zuplo link

After your project is linked, environment variables and other configuration from your Zuplo project will be available in your local development environment.

Start your Project

You can start your project using the following command:

Code
 
npx zuplo dev

After your project is started, you can open the local route designer at http://localhost:9100.

Add the API Key Authentication Policy

Open the local Route Designer by navigating to http://localhost:9100/. Select your route and click Add Policy on the incoming Requeset policies section.

Search for the API key authentication policy, click on it, and then click OK to accept the default policy JSON.

If you test your route, you should get a 401 Unauthorized response

Code
 
{
  "status": 401,
  "title": "Unauthorized",
  "type": "https://httpproblems.com/http-status/401"
}

Set up an API Key

In order to call your API, you need to configure an API consumer. Go to the Zuplo Portal, then open the project you are working on, Services, then click Configure on the "API Key Service".

Then click Create Consumer.

Let's break down the configuration needed.

• Subject: Also known as sub. This is a unique identifier of the API consumer. This is commonly the name of the user or organization consuming your API
• Key managers: The email addresses of those who will be managing this API key.
• Metadata: JSON metadata that will be made available to the runtime when a key is used to authenticate. Common properties include the consumer's subscription plan, organization, etc.

Go ahead and fill in test-consumer for the Subject. Add your own email as a Key manager, and leave the metadata empty for now. Click Save consumer once you're done.

Copy your API Key

After your API Key consumer is created, copy your new API Key by clicking the copy button (next to the eye icon).

Test out your API Key

Using any HTTP client (like Postman or curl), make a request to your API.

Code
 
curl --request GET \
--url http://localhost:9000/path-0 \
--header 'Authorization: Bearer zpka_d67b7e241bb948758f415b79aa8exxxx_2efbxxxx'

You should get a 401 Unauthorized response - as we'ven't supplied the API key yet. Add an new authorization header with the value Bearer <YOUR_API_KEY> and insert the API Key you got from the developer portal.

You should now get a 200 OK.

Code
 
{
  "url": "https://echo.zuplo.io/path-0",
  "method": "GET",
  "query": {},
  "headers": {
    "accept": "*/*",
    "accept-encoding": "gzip, br",
    "connection": "Keep-Alive",
    "host": "echo.zuplo.io",
    "true-client-ip": "12.63.237.42",
    "user-agent": "curl/8.7.1",
    "x-forwarded-proto": "https",
    "x-real-ip": "12.63.237.42",
    "zp-rid": "ecfac0de-f039-4ced-997c-b17c9babc944"
  }
}