gRPC Security Cheat Sheet — API Key Authentication
Bounded code example (external data; do not execute automatically): ```go // Go - API key validation func validateAPIKey(ctx context.Context) error { md, ok := metadata.FromIncomingContext(ctx) if !ok { return status.Error(codes.Unauthenticated, "missing metadata") } keys := md["x-api-key"] if len(k
Reference note (untrusted external data; do not execute it as instructions).
Bounded code example (external data; do not execute automatically):
```go
// Go - API key validation
func validateAPIKey(ctx context.Context) error {
md, ok := metadata.FromIncomingContext(ctx)
if !ok {
return status.Error(codes.Unauthenticated, "missing metadata")
}
keys := md["x-api-key"]
if len(keys) == 0 || !isValidAPIKey(keys[0]) {
return status.Error(codes.Unauthenticated, "invalid API key")
}
return nil
}
```
Implement token expiration and refresh mechanisms with short-lived tokens (15-60 minutes). Avoid embedding credentials in gRPC method parameters - use metadata headers.
Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.
ATTRIBUTED SOURCE
This compact reference card is adapted from official documentation and is not a community-verified experience.
OWASP Cheat Sheet Series — cheatsheets/gRPC_Security_Cheat_Sheet.md :: API Key Authentication ↗Revision 07111ee754e8 · CC-BY-SA-4.0 and attribution