---
title: "Secure Laminas APIs with API Key Authentication"
description: "Secure your Laminas API using a shared secret."
canonicalUrl: "https://zuplo.com/use-cases/api-key-auth/php/laminas/secure-header"
framework: "Laminas"
language: "PHP"
authStrategy: "shared secret header"
pageType: use-case
---

# Secure Laminas APIs with API Key Authentication

Secure your Laminas API using a shared secret.

## How Zuplo Handles It

Put Zuplo in front of your Laminas backend to authenticate API keys and forward a shared secret header so your origin only accepts traffic from Zuplo.

## Laminas Backend Code

```php
use Laminas\Diactoros\Response\JsonResponse;
use Laminas\Diactoros\ServerRequest;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Psr\Http\Server\MiddlewareInterface;
use Laminas\Stratigility\MiddlewarePipe;
use function Laminas\Stratigility\middleware;

class ValidateSharedSecretMiddleware implements MiddlewareInterface
{
    public function process(ServerRequest $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $secret = $request->getHeaderLine('X-Shared-Secret');
        $expectedSecret = getenv('SHARED_SECRET');

        if ($expectedSecret === false) {
            return new JsonResponse(['error' => 'Server configuration error'], 500);
        }

        if (empty($secret)) {
            return new JsonResponse(['error' => 'No secret provided'], 401);
        }

        if (!hash_equals($expectedSecret, $secret)) {
            return new JsonResponse(['error' => 'Invalid secret'], 401);
        }

        return $handler->handle($request);
    }
}

$app = new MiddlewarePipe();

$app->pipe(new ValidateSharedSecretMiddleware());

$app->pipe(middleware(function (ServerRequest $request, RequestHandlerInterface $handler) {
    return new JsonResponse(['message' => 'Access granted']);
}));

// Example usage
$request = new ServerRequest([], [], '/protected');
$response = $app->handle($request);

// Output response
echo $response->getBody();
```

## Example Request

```bash
curl -X GET \
  'https://your-api.zuplo.dev/your-route' \
  -H 'Authorization: Bearer YOUR_API_KEY'
```

## Learn More

- [API Key Authentication on Zuplo](https://zuplo.com/docs/policies/api-key-auth-inbound)
- [JWT Authentication on Zuplo](https://zuplo.com/docs/policies/open-id-jwt-auth-inbound)
- [All use cases](https://zuplo.com/use-cases)