Ktos.AspNetCore.Authentication.ApiKeyHeader 7.0.0

Authentication for ASP.NET Core Security using HTTP header like X-APIKEY and simple single provided key.

This authentication method, while very simple, is of course not suitable for production systems due to potential insecurities. However, as fast and simple method, still could be useful in situations you don't wan't to use token-based security.

Sample usage

Configure your authentication method in Program.cs:

// ...
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = ApiKeyHeaderAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = ApiKeyHeaderAuthenticationDefaults.AuthenticationScheme;
})
    .AddApiKeyHeaderAuthentication(options => options.ApiKey = "my-secret-api-key");

Remember about activating it later:

app.UseAuthentication();
app.UseAuthorization();

It requires you to authenticate to sent X-APIKEY header along with your request, with a value equal to the secret key you set in options, or the request will fail with 401 Unauthorized HTTP error.

curl -X GET \
	'http://localhost:5231/WeatherForecast' \
	-H 'X-APIKEY': 'my-secret-api-key'

var client = new RestClient();
client.BaseUrl = new Uri("http://localhost:5231/WeatherForecast");
var request = new RestRequest(RestSharp.Method.GET);
request.AddHeader("X-APIKEY", "my-secret-api-key");
var response = client.Execute(request);

Of course, you have to ensure your controller or actions are expecting user to be authenticated, for example you can use [Authorize].