---
title: "Configuration"
manual: "API_KEY"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/maikschneider/api-key:configuration@1.0"
source: "Configuration/Index.rst"
rendered: "2026-10-27T08:22:54+00:00"
---

# Configuration {#configuration}

## Frontend middleware {#configuration-middleware}

The extension registers the PSR-15 middleware
`maikschneider/api-key/authentication` in the frontend stack, after
`typo3/cms-frontend/site` and before `typo3/cms-frontend/authentication`.
It authenticates the key of every frontend request once and attaches the
result as request attribute `api_key`. Requests without a key only cost a
header lookup.

The middleware never logs in a frontend or backend user, creates no session
and sends no cookie.

## Extension configuration {#configuration-extension}

-   **rejectInvalidKeys**

    -   *Type:* boolean
    -   *Default:* false

    When enabled, the middleware answers requests with an invalid, revoked or
    expired key with `401` right away:

    ```http
    HTTP/1.1 401 Unauthorized
    Content-Type: application/json; charset=utf-8
    Cache-Control: no-store
    WWW-Authenticate: Bearer realm="api", error="invalid_token"
    WWW-Authenticate: ApiKey realm="api", header="X-API-Key"

    {"error":"invalid_api_key"}
    ```

    Requests without a key and requests with a bearer token of another
    authenticator pass through. When disabled, invalid results are only
    attached to the request and the consuming API decides.