Securing Edge Functions via API Key

[wozdog-oz]

Hi
I've created a test edge function and selected an API key, however looks like when I deploy the function, I can call it without the API key. Am I missing a step to secure the functions?
thanks!

[andinux]

Hi @wozdog-oz.
If you set an API key in the edge function's definition than the key is automatically used for all the requests to the edge function's URL. If don't choose a default API key for your edge function, you need to specify an API key in each request to be able to query your database. The API key can be added to the requests as variable called "apikey" in the query parameters or in the body.

[wozdog-oz]

I did create an api key and selected that key in the function definition. However I can still call the function without the apikey parameter. It would appear that the function definition ignores the selected apikey. This seems to be a bug in the function definition UI?

[andinux]

If you don't want the function to be callable by anyone, you should remove the apikey from the function definition.

For example, in the following example I created an edge function to perform a query to my database, I don't set any APIKEY in the function definition UI. The Test button successfully executes the query because it uses the same privileges of the dashboard user, but if I call the function's URL from a browser without specifying any apikey I receive an "Unauthorized" error:

[wozdog-oz]

Ok, got it now. Works as expected! thanks for your help.