A unique key that identifies the credential for a consumer. The key is encrypted with AES before being stored in etcd. You can also store it in an environment variable and reference it using the $env:// prefix, or in a secret manager such as HashiCorp Vault's KV secrets engine, and reference it using the $secret:// prefix. These gateway references are resolved at runtime. ADC ${NAME} interpolation is different because ADC resolves it while loading the configuration file, before synchronization. For more information, see secrets.

The header to get the key from.

The query string to get the key from. Lower priority than header.

If true, remove the key from the source selected for successful authentication before forwarding upstream. The header has priority over the query parameter, and a lower-priority duplicate is not removed. Before falling back to anonymous_consumer, the gateway removes invalid credentials from both sources. Invalid-credential removal was introduced in API7 Enterprise 3.9.14 and 3.10.1, and in APISIX 3.17.0.

Anonymous consumer name. If configured, allow anonymous users to bypass the authentication. See Rate Limit with Anonymous Consumer for more details.

Realm in the WWW-Authenticate response header returned with a 401 Unauthorized response due to authentication failure. For example:

• If realm is set to key-auth, the 401 response will include the following header:

  WWW-Authenticate: apikey realm="key-auth"
  

• If realm is not configured, the 401 response will include the following header:

  WWW-Authenticate: apikey realm="key"
  

This parameter is available in API7 Enterprise version 3.9.2 and later, and in Apache APISIX version 3.15.0 and later.