Backend Api Key Authorization

tatu.lahtela

Hi,

I'm trying to figure out how api key authorization works. I'm trying to follow this doc https://docs.spryker.com/docs/scos/dev/glue-api-guides/202307.0/use-api-key-authorization.html#how-authentication-works

But looks like the the instructions are quite inadequate. The example in the doc doesn't even compile, there is no setController method in Ruoute and RouteCollection add api is not correctly used. Is there a fully functional example somewhere where the Glue backend api utilizes api keys to a custom api endpoint?

Serhii Chepela

Hey!
Sorry for the broken documentation. We are currently fixing it.

Indeed there is no setController() method and controller and action should be injected via setDefault() method

Currently the only working example of API Key usage is Data Exchange API functionality. This is not the best example due to the fact that we prepare a route in a model and not in the plugin itself, but it should give a hint how it should work.

By integrating API code functionality and adding
->setDefault(static::STRATEGIES_AUTHORIZATION, [static::STRATEGY_AUTHORIZATION_API_KEY]) to your custom rout definition, it should allow you to use X-Api-Key header or api_key URL parameter in order to get access for your resource.

Also I want to add, that currently OOTB only custom routes support this and for regular resources it's not possible yet to use API Key.

Thank you for your post and sorry that documentation was not correct. We are fixing it right now.

https://github.com/spryker/dynamic-entity-backend-api/blob/master/src/Spryker/Glue/DynamicEntityBackendApi/Builder/Route/RouteBuilder.php#L142

simo.savonen

I noticed a @deprecated flag while following the setup guide https://docs.spryker.com/docs/dg/dev/upgrade-and-migrate/migrate-to-decoupled-glue-infrastructure/decoupled-glue-infrastructure-integrate-api-key-authorization.html#set-up-database-schema-and-transfer-objects

In vendor/spryker/authorization/src/Spryker/Zed/Authorization/AuthorizationConfig.php

@deprecated Will be removed with next major. Multistrategy authorization is not supported anymore.

What do you have planned for protecting endpoints with an API key?