> ## Documentation Index
> Fetch the complete documentation index at: https://redop.useagents.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Authentication

> Protect a Redop HTTP server with the built-in apiKey plugin.

Use `apiKey(...)` when you want a simple shared-secret header on HTTP requests.

## Basic example

```ts theme={null}
import { apiKey, Redop } from "@redopjs/redop";

new Redop({ serverInfo: { name: "auth-demo" } })
  .use(
    apiKey({
      key: process.env.API_SECRET ?? "dev-secret",
    }),
  )
  .tool("ping", {
    handler: () => ({ ok: true }),
  });
```

Clients send:

```txt theme={null}
x-api-key: dev-secret
```

## Multiple valid keys

```ts theme={null}
new Redop({ serverInfo: { name: "auth-demo" } }).use(
  apiKey({
    keys: ["dev-key-1", "dev-key-2"],
  }),
);
```

## Custom validation

```ts theme={null}
new Redop({ serverInfo: { name: "auth-demo" } }).use(
  apiKey({
    validateKey: async (value) => value.startsWith("sk-"),
  }),
);
```

## Advanced

Use `contextKey` only if you want the validated key stored somewhere other than `ctx.apiKey`.

## See also

* [JWT authentication](/docs/guides/authentication/jwt)
* [OAuth authentication](/docs/guides/authentication/oauth)
* [Built-in plugins reference](/docs/reference/built-in-plugins)