# Using API Keys with REST

**URL:** <https://www.ruby-forum.com/t/using-api-keys-with-rest/143333>\
**Category:** Rails\
**Created:** [July 17, 2008, 2:05pm UTC](https://www.ruby-forum.com/t/using-api-keys-with-rest/143333 "2008-07-17T14:05:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_ASRichman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/13edae/32.png) [@Mark\_ASRichman](https://www.ruby-forum.com/u/Mark_ASRichman)\
**Post date:** [July 17, 2008, 2:05pm UTC](https://www.ruby-forum.com/t/using-api-keys-with-rest/143333/1 "2008-07-17T14:05:02Z")

</div>

What is the best way to restrict use of the xml format by using an API  
key?

---

<div class="post-metadata">

**Author:** ![Mark\_ASRichman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/13edae/32.png) [@Mark\_ASRichman](https://www.ruby-forum.com/u/Mark_ASRichman)\
**Post date:** [July 17, 2008, 3:52pm UTC](https://www.ruby-forum.com/t/using-api-keys-with-rest/143333/2 "2008-07-17T15:52:42Z")

</div>

I’m guessing you would want to add a before\_filter to your controllers  
and check the request parameters to validate the API key. Or possibly  
even combine that with your user authentication system so that you  
could validate the API key once for the session (assuming the services  
have state).

---

<div class="post-metadata">

**Author:** ![Mark\_ASRichman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/13edae/32.png) [@Mark\_ASRichman](https://www.ruby-forum.com/u/Mark_ASRichman)\
**Post date:** [July 17, 2008, 8:10pm UTC](https://www.ruby-forum.com/t/using-api-keys-with-rest/143333/3 "2008-07-17T20:10:42Z")

</div>

Robert,

I’ve seen many APIs that require the API key in the HTTP header  
itself, as opposed to a request param. How would I parse this out in a  
before\_filter?

If I have a client to a service that requires the same, how do I set  
the API key in the HTTP header of the request?

Thanks,  
Mark

---

<div class="post-metadata">

**Author:** ![Mark\_ASRichman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/13edae/32.png) [@Mark\_ASRichman](https://www.ruby-forum.com/u/Mark_ASRichman)\
**Post date:** [July 18, 2008, 10:50am UTC](https://www.ruby-forum.com/t/using-api-keys-with-rest/143333/4 "2008-07-18T10:50:40Z")

</div>

The controller has a headers hash you can use.

On 17 Jul 2008, at 20:10, Mark A. Richman wrote:

> I’ve seen many APIs that require the API key in the HTTP header  
> itself, as opposed to a request param. How would I parse this out in a  
> before\_filter?

headers[‘api\_key’]

> If I have a client to a service that requires the same, how do I set  
> the API key in the HTTP header of the request?

headers[‘api\_key’] = ‘put ur key here’

Best regards

Peter De Berdt