Struct KeyAuthPlugin 

pub struct KeyAuthPlugin {
    valid_keys: Vec<String>,
    header_name: String,
    query_param: Option<String>,
    use_consumers: bool,
    anonymous_consumer: Option<String>,
    hide_credentials: bool,
    resources: Arc<PluginResources>,
}

Authenticates requests by matching an API key against a configured list and/or the consumer store.

With inline keys, a valid key simply lets the request continue. With use_consumers: true, the key is resolved against the gateway’s consumers: section (their key-auth: {key} credentials); on a match the consumer’s identity is attached to the request (consumer.* keys in context.message plus X-Consumer-* headers) for downstream nodes. Both sources may be enabled together — inline keys are checked first.

Fields

valid_keys: Vec<String>

Exact-match list of accepted API keys.

header_name: String

Lowercased name of the header the key is read from.

query_param: Option<String>

Optional query parameter checked when the header is absent.

use_consumers: bool

When true, keys are also resolved against the consumer store.

anonymous_consumer: Option<String>

Consumer attached when no credential matches (instead of rejecting).

hide_credentials: bool

When true, the matched header/query parameter is removed before the request is forwarded upstream.

resources: Arc<PluginResources>

Implementations

impl KeyAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• keys (array of strings): inline valid API keys.
• use_consumers (bool, default false): also resolve keys against the gateway’s consumers: section and attach the matched consumer.
• At least one of keys / use_consumers must be provided.
• header_name (string, default "x-api-key"): header to read the key from (lowercased).
• query_param (string, optional): query parameter used as a fallback when the header is missing; no fallback if unset.
• anonymous_consumer (string, optional): consumer name attached when no credential matches, instead of rejecting (APISIX semantics).
• hide_credentials (bool, default false): strip the key header/query parameter before proxying upstream.

type: key-auth
config:
  use_consumers: true
  header_name: x-api-key
  query_param: api_key
  hide_credentials: true

fn reject(ctx: Context) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection with a JSON error body and returns a PluginExecutionError (code UNAUTHORIZED) carrying the context so the graph engine routes through the error port.

fn strip_credential(&self, ctx: &mut Context)

Removes the credential from the request (per hide_credentials).

Trait Implementations

impl Plugin for KeyAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.