search

greenpau / caddy-security

🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐
https://authcrunch.com/
Apache License 2.0
1.41k stars 70 forks source link

question: documentation regarding API keys is a bit sparse #116

Open jariz opened 2 years ago

jariz commented 2 years ago

I added an API key from the auth portal settings page at /settings, but now what? I passed it as a bearer token a la Authorization: Bearer API_KEY, but that does not seem to work.

The only doc page that mentions API keys is this one: https://authp.github.io/docs/authorize/basic_api_key_auth I have added with api key auth portal myportal realm local to my policy.

Is there something obvious I'm missing here? Or am I just not understanding what purpose API keys are supposed to serve? My goal is to make a never expiring API key that I can use to give external services access to my services behind the authorize directive.

Thanks in advance, this project is great @greenpau.

greenpau commented 2 years ago

@jariz , please share your config.

it is not “authorization Bearer”. Rather, pass X-API-Token header with the value of the key you’d created

jariz commented 2 years ago

Hi @greenpau, thanks for your quick response.

X-API-Token did not work, but X-Api-Key did 😬 .

Maybe this should be documented a bit more? I can't find any mention of X-API-Key in the docs. I have heard about this header before, but I wouldn't say it's super obvious, perse.

Regardless, thanks!

greenpau commented 2 years ago

@jariz , let’s keep it open. Will address it next week

greenpau commented 2 years ago

@jariz , please help promote this project … if you like of course 😃