---
title: "What is API key authentication in .NET Core Web API?"  
description: "What is API key authentication in .NET Core Web API?"  
author: "Ravi Misra"  
published: 2023-08-30  
updated: 2023-09-02  
canonical: https://www.mindstick.com/forum/159739/what-is-api-key-authentication-in-dot-net-core-web-api  
category: "web api"  
tags: [".net", ".net core", ".net core api"]  
reading_time: 3 minutes  

---

# What is API key authentication in .NET Core Web API?

[Explain the concept](https://www.mindstick.com/forum/159605/explain-the-concept-of-unique-key-violation-error) of [API key authentication](https://www.mindstick.com/forum/159745/how-would-you-test-api-key-authentication-in-a-dot-net-core-web-api) and how it's used to [secure](https://www.mindstick.com/articles/44535/smart-ways-to-secure-self-storage-facilities) [access](https://www.mindstick.com/articles/12994/how-foreigners-can-access-blocked-websites-in-china) to your API endpoints. Discuss its [benefits](https://www.mindstick.com/articles/75377/surprising-benefits-of-learning-to-code) and [potential](https://www.mindstick.com/news/2501/why-wind-energy-isn-t-preventing-pollution-to-the-extent-that-it-could) drawbacks.

## Replies

### Reply by Aryan Kumar

[API](https://www.mindstick.com/articles/12641/instagram-api-upgraded-to-facebook-graph) key [authentication](https://www.mindstick.com/blog/177/authentication-and-authorization-in-asp-dot-net) is a type of authentication that uses a secret key to authorize access to an API. The secret key is typically sent in the header of the HTTP request.

In a .NET Core web API, API key authentication can be implemented using the `ApiKeyMiddleware` class. The `ApiKeyMiddleware` class allows you to customize the following aspects of API key authentication:

- The header that the API key is sent in.
- The format of the API key.
- The way that the API key is validated.
- The way that unauthorized requests are handled.

To use the `ApiKeyMiddleware` class, you need to add it to the middleware pipeline in your application. You can do this by adding the following code to your `Startup` class:

C#

```plaintext
app.UseMiddleware<ApiKeyMiddleware>();
```

You can then customize the behavior of the `ApiKeyMiddleware` class by setting the appropriate properties. For example, to change the header that the API key is sent in, you can set the `HeaderName` property.

The following code shows how to change the header that the API key is sent in:

C#

```plaintext
app.UseMiddleware<ApiKeyMiddleware>(
    options => options.HeaderName = "X-Api-Key");
```

You can also customize the format of the API key by setting the `KeyFormat` property. The `KeyFormat` property can be set to one of the following values:

- `PlainText`: The API key is sent in plain text.
- `Hashed`: The API key is hashed before it is sent.
- `Encrypted`: The API key is encrypted before it is sent.

The following code shows how to change the format of the API key:

C#

```plaintext
app.UseMiddleware<ApiKeyMiddleware>(
    options => options.KeyFormat = ApiKeyFormat.Hashed);
```

Finally, you can customize the way that unauthorized requests are handled by setting the `OnUnauthorized` property. The `OnUnauthorized` property can be set to a delegate that will be called when an unauthorized request is received.

The following code shows how to change the way that unauthorized requests are handled:

C#

```plaintext
app.UseMiddleware<ApiKeyMiddleware>(
    options => options.OnUnauthorized =
        (context, exception) => context.Response.StatusCode = 401);
```

By customizing the behavior of the `ApiKeyMiddleware` class, you can tailor API key authentication to the specific needs of your application.

Here are some additional considerations when using API key authentication in a .NET Core web API:

- **The header that the API key is sent in:** The header that the API key is sent in should be a header that is not commonly used by other applications.
- **The format of the API key:** The format of the API key should be secure and difficult to guess.
- **The way that the API key is validated:** The API key should be validated against a secure store.
- **The way that unauthorized requests are handled:** Unauthorized requests should be handled in a way that does not compromise the security of the application.

By following these considerations, you can ensure that API key authentication is secure and effective.


---

Original Source: https://www.mindstick.com/forum/159739/what-is-api-key-authentication-in-dot-net-core-web-api

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.