How to configure customer-specific API keys for Azure Functions

10
votes

I want to create a C# Azure Function with http trigger. I want to secure it with an API Key, provide a separate key per customer, and the function should provide customer-specific data so needs to identify who is calling it.

Can I use Azure Function API Keys to identify the customer, e.g. get the name of the Key that has been passed? Or is there no way of knowing within the azure function which key was used to authenticate the request?

If there were a method like GetApiKeyName() I could check the key name against a list of customers in my database and return different data based on who is calling the function. e.g. imagine I have a sales-tracking system and my function is /api/GetMonthlySales. If customer 1 calls the function with their API key they should get their monthly sales and if customer 2 calls it they'd get a different amount.

If this isn't possible that means I need to give additional authentication data to each customer for them to pass to each function call, e.g. a customer Id and a secret Key. But this defeats the purpose of using Azure Functions API Keys, right?

A similar scenario would be if I want to charge customers when they call my function. How do I identify which customer is calling my function?

2
c#azureazure-webjobsazure-functions
For now I decided to use the Azure authentication and put those same api keys into the db. Then I know that Azure is ensuring only someone with a valid key is calling the function, and I look up who that is by grabbing the querystring code parameter and finding it in the DB. To provision new customers I need to both add them to Azure Function auth and then add them to my DB. Hopefully in future there'll be inbuilt support for this but it's not too cumbersome this way if you have few customers. – Rory

2 Answers

8
votes

Rory,

This is unfortunately not supported today. The authentication will happen based on key used and you can revoke/renew individual client keys, but that information is not currently surfaced to the functions.

There are some workarounds like mapping the keys by using the management API and matching the request key to identify the client, but they are cumbersome and inefficient.

I've had an issue tracking this here and I have just marked it for triage again to see if we can get this addressed soon.

0
votes

I think the prefereed way would be to use Api Management. In Api Management you can configure your custom authentication.

To ensure no one else than Api Management will request your function, turn on App Service Authentication / Authorization for your function app and only allow Api Management to access it.