Weik.io

API Subscriptions

Manage API access and authentication with subscriptions

API Subscriptions control which clients can access your APIs and how they authenticate.

Configuration

At a minimum, a subscription defines which APIs it grants access to.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: mobile-app-subscription
  description: Subscription for mobile application
spec:
  apis:
    - users-api
    - orders-api
  isActive: true
  parameters:
    key: "your-api-key"

Properties

PropertyTypeRequiredDescription
apisstring[]YesList of API names this subscription grants access to
isActiveboolNoWhether the subscription is active (default: true)
parametersobjectNoAuthentication and configuration parameters
additionalHeadersobjectNoHTTP headers to include in requests
variablesobjectNoVariables specific to this subscription

Authentication examples

The authentication method is determined by the category field in the metadata. The following examples show common configurations.

API key

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: my-apikey
  category: apikey
spec:
  apis:
    - petstore
  isActive: true
  parameters:
    key: "NGWdkceFPYyXmaH15jS3K0uCsk7KnnPA"

Basic authentication

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: dev-basicauth
  category: basic
spec:
  apis:
    - petstore
  isActive: true
  parameters:
    username: "hello"
    password: "test123"

OpenID Connect

If your APIs use an identity provider such as Entra ID, Keycloak, or Auth0, use OIDC to validate tokens.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: oidc-aad
  category: oidc
spec:
  apis:
    - petstore
  isActive: true
  parameters:
    issuer: "https://sts.windows.net/37e55da6-fb62-456a-8d8e-f6f5b649092f/"
    audience: "api://f2f62be5-bc3a-4786-b42c-209a4e0f22bb"
  additionalHeaders:
    custom-source: 'entra'
    anotherdata: 'More header data for this subscription'

Anonymous

To allow unauthenticated access, declare it explicitly with the anonymous category.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: anonymous-apis
  category: anonymous
spec:
  apis:
    - webhook
  isActive: true

Additional headers

If you define additionalHeaders, the proxy injects them into every request that passes through this subscription. This is useful for tagging requests with tenant IDs or tracking sources without requiring the client to send them.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: partner-subscription
spec:
  apis:
    - partner-api
  isActive: true
  additionalHeaders:
    X-Partner-Id: partner-123
    X-Request-Source: partner-portal

Variables

Avoid hardcoding secrets such as API keys in YAML files. Use variables to read them from the environment or a secure store instead.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: partner-subscription
spec:
  apis:
    - partner-api
  isActive: true
  parameters:
    apiKey: "{{apiKey}}"
  variables:
    apiKey: "{{sys:PARTNER_API_KEY}}"

See Using Variables for details on variable resolution.

Next steps