Admin API Key

Admin API keys are used to control access to the APISIX Admin API endpoints, allowing only authorized users to manage and administer APISIX resources via the Admin API.

Key Requirement and Permissions

It is strongly recommended that you switch on the mandatory requirement of Admin API keys in production and configure a set of complex keys to harden your APISIX instances.

The default configuration file includes the following details, where Admin API key is required by default and set to fixed values:

config-default.yaml

deployment:
  admin:
    admin_key_required: true
    admin_key:
      -
        name: admin
        key: edd1c9f034335f136f87ad84b625c8f1
        role: admin    # read and write access
      -
        name: viewer
        key: 4054f7cf07e344346cd3f287985e76a2
        role: viewer   # read-only access

To modify these configurations for your deployment, add the custom configurations to the config.yaml configuration file and reload APISIX for changes to take effect.

Other Admin API Security Options

In addition to setting the Admin API keys, you can also customize other configurations to further secure the Admin API, such as:

• Admin API CORS
• Admin API Access IP whitelist
• Admin API mTLS

For a complete list of configuration options, see config-default.yaml.