---
schema_version: "1"
id: 68576675ac215fc2f45d13dc353011eef5edf21ad28e64967eda79adbd7946c5
title: Credential Injection API Key Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-outbound-api-key.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-outbound-api-key
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 8402cdf95a6e485438b2c9c25d7681cf740c2f9ebe2cb76851dc2bc45b36249b
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: api key, client credentials, authentication, api gateway, flex gateway, gateway, policy
---

# Credential Injection API Key Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Credential Injection API Key</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Injects an API key or client credentials headers into outgoing requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.10.2</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/outbound-api-key-release-notes">Credential Injection API Key</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy. Error codes are returned from the upstream service.</p></td></tr></tbody></table>

## Summary

The Credential Injection API Key policy injects authentication credentials into upstream requests to
authenticate with upstream services that require API key or client credential authentication. The
policy supports two authentication types:

- **API Key**: Injects an API key value into the `Authorization` header or a custom header.

- **Client ID and Secret**: Injects the client ID and client secret value into the `client_id` and
  `client_secret` headers or custom headers.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: credential-injection-api-key-flex config: authType: <string> // REQUIRED
overwrite: <boolean> // REQUIRED, default: true # For API Key authentication: apiKey: <string> //
REQUIRED when authType is "apiKey" customHeader: <string> // OPTIONAL when authType is "apiKey" #
For Client Credentials authentication: clientId: <string> // REQUIRED when authType is
"clientCredentials" clientSecret: <string> // REQUIRED when authType is "clientCredentials"
customClientIdHeader: <string> // OPTIONAL when authType is "clientCredentials"
customClientSecretHeader: <string> // OPTIONAL when authType is "clientCredentials"

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>authType</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>apiKey</code></p></div></div></td><td><div><div><p>Authentication type to inject, either <code>apiKey</code> or <code>clientCredentials</code>.</p></div></div></td></tr><tr><td><div><div><p><code>overwrite</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>Overwrite authentication headers if present in the request.</p></div></div></td></tr><tr><td><div><div><p><code>apiKey</code></p></div></div></td><td><div><div><p>Required when <code>authType</code> is <code>apiKey</code>.</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The API key value to inject.</p></div></div></td></tr><tr><td><div><div><p><code>customHeader</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Use a custom header name instead of <code>Authorization</code> for API key injection.</p></div></div></td></tr><tr><td><div><div><p><code>clientId</code></p></div></div></td><td><div><div><p>Required when <code>authType</code> is <code>clientCredentials</code>.</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The client ID to inject.</p></div></div></td></tr><tr><td><div><div><p><code>clientSecret</code></p></div></div></td><td><div><div><p>Required when <code>authType</code> is <code>clientCredentials</code>.</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The client secret to inject.</p></div></div></td></tr><tr><td><div><div><p><code>customClientIdHeader</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Use a custom header instead of <code>client_id</code> for client ID injection.</p></div></div></td></tr><tr><td><div><div><p><code>customClientSecretHeader</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Use a custom header instead of <code>client_secret</code> for client secret injection.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Examples

- API Key:

  \- policyRef: name: credential-injection-api-key-flex config: authType: apiKey apiKey:
  my-secret-api-key overwrite: true

- API Key with Custom Header:

  \- policyRef: name: credential-injection-api-key-flex config: authType: apiKey apiKey:
  my-secret-api-key customHeader: X-API-Key overwrite: false

- Client Credentials:

  \- policyRef: name: credential-injection-api-key-flex config: authType: clientCredentials
  clientId: my-client-id clientSecret: my-client-secret overwrite: true

- Client Credentials with Custom Headers:

  \- policyRef: name: credential-injection-api-key-flex config: authType: clientCredentials
  clientId: my-client-id clientSecret: my-client-secret customClientIdHeader: X-Client-ID
  customClientSecretHeader: X-Client-Secret overwrite: false

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th></tr></thead><tbody><tr><td><p><strong>Authentication Type</strong></p></td><td><p>Type of authentication header to inject: <strong>API Key</strong> or <strong>Client ID and Secret</strong>.</p></td></tr><tr><td><p><strong>Overwrite headers</strong></p></td><td><p>Overwrite authentication headers if present in the request.</p></td></tr><tr><td><p><strong>API Key</strong></p></td><td><p>The API key value to inject.</p></td></tr><tr><td><p><strong>Custom header</strong></p></td><td><p>Use a custom header instead of Authorization for API key injection.</p></td></tr><tr><td><p><strong>Client ID</strong></p></td><td><p>The client ID to inject.</p></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><p>The client secret to inject.</p></td></tr><tr><td><p><strong>Custom Client ID header</strong></p></td><td><p>Use a custom header instead of <code>client_id</code> for client ID injection.</p></td></tr><tr><td><p><strong>Custom Client secret header</strong></p></td><td><p>Use a custom header instead of <code>client_secret</code> for client secret injection.</p></td></tr></tbody></table>