what is the use of consumer secret in an api request to an api proxy of security type 'api key'

[#1]

When you secure your API proxy using either apikey type or oauth and use their relevent api products in your app you get a consumer key and a consumer secret. In case of oauth you exchange these 2 for an access token which you then use in your api request headers. But in case of api key authentication type, you can just pass the consumer key (which is also referred to as api key in documentation http://docs.apigee.com/tutorials/secure-calls-your-api-through-api-key-validation) If the app just needs an api key to proceed with sending requests what is the point in issuing a secret as well ? Is it used for any other purpose ?

[anilsr · Accepted solution]

@msm ,

In API Key Verification, Yes, Secret is not used. In general, Apigee generates both the keys. It's upto you which security mechanism you would like to use. Depending on the security mechanism you choose, You will use API Key and / or Secret.

Hope it helps.

[DChiesa]

Just an addendum....

In API Key verification, the secret is not used, as Anil said.

BUT, it is possible to compose multiple levels of security into a single system.

For example, imagine an API that requires an HMAC of the payload to be sent in the header. (An HMAC is just a keyed MAC). In this case, the consumer key is the ... API key, and the consumer secret is the "shared secret" that is used by the client for computing the HMAC and used by the server (API Proxy in this case) for verifying the HMAC.

The request would look like:

POST /foo/bar
Host: my-api.example.com
APIKey: 238hckjshcf9834rudd
HMAC: 94380984059849209432uj3wrj93493
...

...and the way the client produces the HMAC is

hmac = HmacFunction(key, message)

...where key is the consumer secret and "message" is whatever is being MAC'd. Like the message payload, or ... some combination of the URL path, the headers, and the date, or... anything you like.

OAuth1.0a used basically this method.

The way you would implement this in Apigee Edge is:

• VerifyApiKey - to verify the inbound API Key. This step also implicitly loads the consumer secret into the message context, in the API Proxy.
• JS or Java callout to compute the HMAC, using whatever payload is appropriate and the consumer secret that was loaded in the prior step.
• throw a fault if the computed HMAC does not match the transmitted HMAC. You can do this in the proxy flow, or in the JS or Java callout.

There is a Java callout published here that calculates and verifies HMACs, along with a working demonstration proxy.