drive-apig
v2.4.2

Auth & API keys

Primary HTTP authentication is API Gateway API keys in the X-Api-Key header. The repo does not use OAuth, Cognito, or JWT for the shared public API surface.

The private flag

Serverless HTTP events control API Gateway key enforcement with private:

yaml
events:
  - http:
      path: /marketplace/colours/
      method: post
      private: true
FlagGateway behaviorUse
private: trueRequires a valid API key associated with the method/stageInternal callers, partner integrations, cost-incurring handlers
private: falseNo API key check at API GatewayPublic browser endpoints and third-party webhooks

Set private: false explicitly for public endpoints. Omitting it under a provider that declares API keys can leave the route key-required.

API keys and usage plans

The shared provider config creates two named keys per service per stage:

KeyIntended caller
${stage}-${service}-api-keyInternal Drive callers
${stage}-${service}-api-key-externalExternal partners

Terraform owns usage plans, throttling, quotas, and API Gateway stage wiring. A missing or invalid key on a private: true method fails before Lambda invocation and usually returns { "message": "Forbidden" }.

Handler-level checks

Public at API Gateway does not always mean unauthenticated:

  • POST /leads/bot/queue performs an additional bearer-token check in the handler and returns 401 on failure.
  • Facebook leadgen verification uses hub.verify_token for GET /leads/in/fb/queue; Facebook POST handling is public at API Gateway but still constrained by webhook-specific checks and WAF controls.
  • Marketing callback proxy requires X-Ins-Auth to be present before forwarding callback payloads.

Use the per-operation OpenAPI schema and owning handler when you need the full auth contract.

Request headers

The primary auth header is X-Api-Key. Authorization and X-Amz-* headers are allowed because some callers use SigV4/IAM-style request signing, but they are not the standard drive-apig auth path.

See Headers for the shared CORS allow-list.

Esc
Esc Close