Can the VerifyApiKey policy work without enabling an API product ?

[#1]

Hi

In a video lecture i see you enabled API product : Premium Weather API in Test and Prod as it is disabled. In experimenting, i tested the VerifyApiKey example without enabling it and it works perfectly fine.

Any reasons for that ?

Regards

Sumeet Chawla

[#2 · Accepted solution]

If you call an API with a VerifyApiKey policy in it, if you don't provide an apikey parameter, it should fail with a 401 error. Do you know if the Continue on Error setting on the policy is set to true? You should never do that in production, but it may explain why you are getting past the VerifyApiKey policy.