Configuration 

Frontend middleware 

The extension registers the PSR-15 middleware maikschneider/api-key/authentication in the frontend stack, after typo3/cms-frontend/site and before typo3/cms-frontend/authentication. It authenticates the key of every frontend request once and attaches the result as request attribute api_key. Requests without a key only cost a header lookup.

The middleware never logs in a frontend or backend user, creates no session and sends no cookie.

Extension configuration 

rejectInvalidKeys
Type
boolean
Default
false

When enabled, the middleware answers requests with an invalid, revoked or expired key with 401 right away:

HTTP/1.1 401 Unauthorized
Content-Type: application/json; charset=utf-8
Cache-Control: no-store
WWW-Authenticate: Bearer realm="api", error="invalid_token"
WWW-Authenticate: ApiKey realm="api", header="X-API-Key"

{"error":"invalid_api_key"}
Copied!

Requests without a key and requests with a bearer token of another authenticator pass through. When disabled, invalid results are only attached to the request and the consuming API decides.