In API gateway I have the two options to pass the API Key whether in the query string or in the header. Is there’s any way to prevent the API Key value to be passed as a query parameter and only enforced the API Key in the header?

Thanks in advance

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/1899051ffa53b1ea0831fedd0b170ebc2cafd0da_2_1035x399.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/1899051ffa53b1ea0831fedd0b170ebc2cafd0da_2_1380x532.png 2x" data-dominant-color="F7F5F5">

Untitled2128×822 88.5 KB

Hi Mohamed,

I am not aware of any such OOTB option to disable this. You could use a custom extension to remove the query parameter before the IAM (Identify & Authorize) policy is executed. That way IAM will always receive the request without the query parameter and it will not allow the request based on API Key from the query parameter and hence always enforce the API Key header.

Hope this helps.

Regards,
Vallab.