# Securing Content REST API with api key

**URL:** <https://community.bloomreach.com/t/securing-content-rest-api-with-api-key/2343>\
**Category:** Experience Manager (PaaS/OnPrem)\
**Created:** [January 21, 2021, 9:11pm UTC](https://community.bloomreach.com/t/securing-content-rest-api-with-api-key/2343 "2021-01-21T21:11:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hcu](https://avatars.discourse-cdn.com/v4/letter/h/58956e/32.png) [@hcu](https://community.bloomreach.com/u/hcu)\
**Post date:** [January 21, 2021, 9:11pm UTC](https://community.bloomreach.com/t/securing-content-rest-api-with-api-key/2343/1 "2021-01-21T21:11:52Z")

</div>

Hil all, I’m exposing the Content REST API via a preview (hst:type = preview) so I can also access unpublished content from an external service. And logically I want to secure this API as it’s not supposed to available to the public.

Is there a way to protect the Content REST API with an api key (that consumers have to specify in a x-api-key request header)?

Update:  
By Content REST API i meant the generic REST API that comes out of the box. The preview endpoints for this API I want to secure with an api key are, for example:

- /site/preview/api/documents
- /site/preview/api/documents/{id}

---

<div class="post-metadata">

**Author:** ![machak](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/machak/32/1298_2.png) [@machak](https://community.bloomreach.com/u/machak)\
**Post date:** [January 21, 2021, 10:54pm UTC](https://community.bloomreach.com/t/securing-content-rest-api-with-api-key/2343/2 "2021-01-21T22:54:56Z")

</div>

By default we use basic authentication (user needs to be a CMS user). To change it to something else you can read this document:

> **[Repository JAX-RS Service - Bloomreach Experience - Open Source CMS](https://documentation.bloomreach.com/14/library/concepts/hippo-services/repository-jaxrs-service.html)**
>
> Open Source Enterprise Content Management

Other option is to use Spring security.  
(see also [HST Spring Security Support Documentation – Introduction](https://bloomreach-forge.github.io/hst-spring-security/index.html) )

---

<div class="post-metadata">

**Author:** ![machak](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/machak/32/1298_2.png) [@machak](https://community.bloomreach.com/u/machak)\
**Post date:** [January 21, 2021, 10:58pm UTC](https://community.bloomreach.com/t/securing-content-rest-api-with-api-key/2343/3 "2021-01-21T22:58:59Z")

</div>

forgot to say, for default basic authentication check:

> **[RESTful JAX-RS Component Support - Bloomreach Experience - Open Source CMS](https://documentation.bloomreach.com/14/library/concepts/rest/restful-jax-rs-component-support-in-hst-2.html)**
>
> Open Source Enterprise Content Management

RolesAllowed annotation mainly, e.g:

```
 @RolesAllowed(value={"author", "editor"})
```

---

<div class="post-metadata">

**Author:** ![hcu](https://avatars.discourse-cdn.com/v4/letter/h/58956e/32.png) [@hcu](https://community.bloomreach.com/u/hcu)\
**Post date:** [January 22, 2021, 12:36am UTC](https://community.bloomreach.com/t/securing-content-rest-api-with-api-key/2343/4 "2021-01-22T00:36:42Z")

</div>

@machak Thanks again for the reply.

I’ve updated my question and added that it’s regarding the generic Content REST API that comes out of the box. (Instead of a custom jax-rs service)

From the documentation (see link below) I understood that it’s possible to enable basic authentication. However I was wondering if there’s a way to add an api key check to specific endpoints.

Regarding basic authentication, according to the documention it’s possible to enable basic authentication (see link below). However, the documentation also says that by default form-based authentication is configured on the delivery tier. My questions in this regard are:

1. When I enable basic authentication does it mean that all secured delivery tier services will get basic authentication (like the site preview)?
2. Can’t each service be configured to use a different AuthenticationProvider?
3. Is it possible to have a user that can access the API endpoints (through basic authentication), but has no or minimum permissions in the CMS?

Enable authentication: [Add a preview channel and limit access - Bloomreach Experience - Open Source CMS](https://documentation.bloomreach.com/14/library/concepts/security/authorization-use-cases/add-a-preview-channel-and-limit-access.html)

Configure Basic Authentication: [Configure the Delivery Tier to Use Basic Authentication - Bloomreach Experience - Open Source CMS](https://documentation.bloomreach.com/14/library/concepts/security/configure-delivery-tier-basic-authentication.html)