api_key in header doesn't work at all

[gcsgit]

Pretty much what the title says. It shows in the sample curl command, but if you look at the request headers, it isn't there.

[jayquest]

+1

[richardkerr]

I've spent far too long looking at this. The problem is that the method used in the docs (window.swaggerUi.api.clientAuthorizations.add) will only add the header if it is present in the "security" element of the operation, within the api-docs.

In the pet store example (http://petstore.swagger.io/v2/swagger.json), GET /pet/{petId} will allow the api_key parameter, but POST to the same endpoint will only apply the OAUTH security (petstore_auth).

This also seems to mean that there is no mechanism to arbitrarily set header values, which the documentation leads us to believe.

[fehguy]

Hi, by design, you must specify where the header needs to be applied. For example, if you want to secure every operation, you should add the security attribute at the top level. If you want to do so on a more granular level, do it at each operation.

If you want to add arbitrary headers, you are correct--the security scheme supports adding named headers as defined in the securityDefinition section of the spec (see https://github.com/swagger-api/swagger-spec/blob/master/versions/2.0.md#securityDefinitionsObject) for details.

If you want to add arbitrary headers, please use the appropriate mechanism, which is done via creating a custom request signing mechanism (see https://github.com/swagger-api/swagger-js#custom-request-signing).

These tools should give you what you're looking for. If they're hard to find, hard to understand, or don't behave the way you'd expect, please open a bug.

[rngtng]

+1, I ran into the same problem. What I understood from the docs, my definition (see below, securityDefinitions and security on root level) would add --header "mykey: #{api_key}" to the request. Dosen't work at all, so is it meant to work or do I need to customize swagger-ui??

"securityDefinitions": {
    "mykey": {
      "type": "apiKey",
      "name": "mykey",
      "in": "header"
    }
  },
  "security": [
    {
      "mykey": []
    }
  ]

[jayquest]

I have solve the problem for me, and just create a pull request with my modifications.
link to the pull request

[glspm]

Maybe it could be just added drop-down for selecting the place where to put api_key, into "header", or as a "query param".
That drop-down could be next to api_key input field.

It is weird it only supports api_key as a query parameter (hardcoded) since it is a bad practice in general.

[fehguy]

Please re-test with master, #2014 should address this.