Regira-Packages

Regira Security — API Key Authentication

API key authentication from Regira.Security.Authentication — for machine callers that cannot perform an interactive sign-in.

---

API Key Authentication

ApiKeyAuthenticationOptions

Property	Type	Default	Description
ApiKeyHeaderName	string	"X-Api-Key"	Request header name
AuthenticationType	string	"ApiKey"	Authentication type string

IApiKeyOwnerService

Task<ApiKeyOwner?> FindByOwner(string id);
Task<ApiKeyOwner?> FindByKey(string apiKey);
Task<bool>         Validate(string id, string apiKey);

ApiKeyOwner model

Property	Type	Description
OwnerId	string	Owner identifier
Key	string	API key value
Roles	ICollection<string>	Roles assigned to this key
Claims	ICollection<ApiKeyOwner.Claim>	Extra claims (Type / Value pairs) added to the principal

DI registration

var services = new ServiceCollection();
IConfiguration configuration = new ConfigurationManager();

// In-memory keys from code
services.AddApiKeyAuthentication()
        .AddInMemoryApiKeyAuthentication(new[]
        {
            new ApiKeyOwner { OwnerId = "client-a", Key = "key-abc", Roles = ["read"] }
        });

// From appsettings.json
var keys = configuration.GetSection(AuthenticationSections.ApiKeys).ToApiKeyOwners();
services.AddApiKeyAuthentication()
        .AddInMemoryApiKeyAuthentication(keys);

appsettings.json shape — an array, each entry carrying its own OwnerId. ToApiKeyOwners() requires both fields, so an object keyed by owner name throws InvalidOperationException at startup:

"ApiKeys": [
  { "OwnerId": "client-a", "Key": "key-abc", "Roles": ["read", "write"] }
]

---

Overview

1. Index — Overview, projects, and choosing a scheme
2. Encryption & Hashing — Symmetric encryption, PBKDF2 and BCrypt password hashing
3. JWT Authentication — Self-issued bearer tokens, claims, and refresh tokens
4. API Key Authentication — Key-based auth for machine callers
5. External Identity Providers — Validating external bearer tokens; OpenID Connect sign-in
6. Cookie Authentication — Cookie-backed sessions
7. Composing Multiple Schemes — Running several schemes side by side
8. Pre-built Auth Controllers — Account, password and user endpoints
9. Practical Examples — Complete implementation examples

License

Apache License 2.0 — this package contains no license validation and no runtime limits. See LICENSE. A few companion packages are commercially licensed with a free tier; see the licensing overview.

This site is open source. Improve this page.