How to validate api key on gateway?

[BCantos17]

Have an Apollo Gateway app and cannot find a documentation on how to inspect the header in order to validate an API Auth Key and then based on that validation, allow the query to continue. There is a introspectionHeaders method but that is deprecated and I have a federated graph so introspection in general seems out of the question.

Seems like willSendRequest is suppose to do something like that but all I found when googling was how to modify the context to add to the header and not to validate a pre-existing key in the header to allow to query to continue.

Is something like this possible?

[glasser]

One option is just to do this as a middleware in your Express (or whatever) app before the Apollo Server middleware.

In theory, your context function might be a good place to do this, or requestWillStart, but I'll admit that error handling around these functions is not ideal in Apollo Server (especially in AS3; maybe a bit better in the forthcoming AS4).

[glasser]

Take a look at https://www.apollographql.com/docs/apollo-server/integrations/middleware/#swapping-out-apollo-server

[BCantos17]

Thank you, this is helpful! I am going to attempt this and will get back on the results

[BCantos17]

This worked but not exactly as I expected it to. I cannot reach the landing page for the gateway without the api key. I think this will do for my current needs but I was wondering if there are/were any discussions about doing something like this on the gateway level so that way I can go to the landing page but not make any queries without adding the api key in the header?

[glasser]

Might not be want you want to hear, but: you can mimic the logic that Apollo Server does to decide if it's serving the landing page. (Basically based on the accept header)

[BCantos17]

that works! It's not my ideal solution but this does exactly what I expected. Thanks a lot