A unique key that identifies the credential for a consumer. The key is encrypted with AES before being stored in etcd. You can also store it in an environment variable and reference it using the env:// prefix, or in a secret manager such as HashiCorp Vault's KV secrets engine, and reference it using the secret:// prefix. For more information, see secrets (opens in Apache APISIX docs).

The header to get the key from.

The query string to get the key from. Lower priority than header.

If true, remove the configured credential header and query parameter before forwarding upstream. Before falling back to anonymous_consumer, the gateway also removes invalid credentials. Invalid-credential removal was introduced in API7 Enterprise 3.9.14 and 3.10.1, and in APISIX 3.17.0.

Anonymous consumer name. If configured, allow anonymous users to bypass the authentication. See Rate Limit with Anonymous Consumer for more details.

Realm in the WWW-Authenticate response header returned with a 401 Unauthorized response due to authentication failure. For example:

• If realm is set to key-auth, the 401 response will include the following header:

  WWW-Authenticate: apikey realm="key-auth"

• If realm is not configured, the 401 response will include the following header:

  WWW-Authenticate: apikey realm="key"

This parameter is available in API7 Enterprise version 3.9.2 and later, and in Apache APISIX version 3.15.0 and later.