Google API Gateway: Provide API key in header

Question

I'm trying to setup Google API Gateway to use an API key that callers send in the header.
My api config yaml looks like this:

...
securityDefinitions:
  api_key_header:
    type: apiKey
    name: key
    in: header
  api_key_query:
    type: apiKey
    name: key
    in: query
paths:
  /foo-header:
    get:
      summary: Test foo endpoint
      operationId: testGet-header
      x-google-backend:
        address: "<backend address>"
        protocol: h2
        path_translation: APPEND_PATH_TO_ADDRESS
      security:
        - api_key_header: []
      responses:
        204:
          description: A successful response
  /foo-query:
    get:
      summary: Test foo endpoint
      operationId: testGet-header
      x-google-backend:
        address: "<backend address>"
        protocol: h2
        path_translation: APPEND_PATH_TO_ADDRESS
      security:
        - api_key_query: []
      responses:
        204:
          description: A successful response 

I expect both calls, /foo-header and /foo-query to fail with 401 status if a valid API key is not provided via header or query parameter.

But in a fact only /foo-query behaves as expected.
Requests to /foo-header pass to the backend even when the API key is not provided in request header.

Do I have issue with the config, or is it the Google API Gateway that doesn't work properly when API key is provided in request header?

Answer 1

When in is header, the name should be x-api-key.

https://cloud.google.com/endpoints/docs/openapi/openapi-limitations#api_key_definition_limitations