Add API Key authentication support to CRUD API Plugin #1650

Summary

Add support for API Key authentication to the CRUD API Plugin. Currently, the only supported authentication method is Microsoft Entra ID (see Entra auth how-to and CrudApiPlugin reference). Many APIs use API Key authentication, and Dev Proxy should support simulating this scenario as well.

Spec

Following the existing pattern used for Entra auth, we should add a new apiKey auth mode and a corresponding apiKeyAuthConfig section. This update will support passing keys via a header, or a request query-string.

Proposed API file schema

{
  "$schema": "...",
  "baseUrl": "https://api.contoso.com/v1/customers",
  "dataFile": "customers-data.json",
  "auth": "apiKey",
  "apiKeyAuthConfig": {
    "headerName": "x-api-key",
    "apiKey": "my-secret-key",
    "queryParameterName": "api_key"
  },
  "actions": [
    { "action": "getAll" },
    { "action": "getOne", "url": "/{customer-id}", "query": "$.[?(@.id == {customer-id})]" },
    { "action": "create" },
    { "action": "merge", "url": "/{customer-id}", "query": "$.[?(@.id == {customer-id})]" },
    { "action": "update", "url": "/{customer-id}", "query": "$.[?(@.id == {customer-id})]" },
    { "action": "delete", "url": "/{customer-id}", "query": "$.[?(@.id == {customer-id})]" }
  ]
}

Configuration properties

Behavior

• When auth is set to "apiKey", the plugin checks the configured header or query parameter for the valid API key on every request.
• If both the header and the query parameter are configured, the plugin checks both locations for the API key. If either carries the valid key, the request is authorized.
• If neither the header nor query param is present or valid, return 401 Unauthorized.
• If the key is valid, the request proceeds normally.