Ocp-Apim-Subscription-Key

Question

Hi guys,

need to insert to the header Ocp-Apim-Subscription-Key on backed serverice (APIM) to not expose the key on client side (browser/js).

When I edit inbound policy and add set header, GET method still not works (Direct from browser or from Postman). From Postman if I explicitly add to header Ocp-Apim-Subscription-Key key, respons work.

{
    "statusCode": 401,
    "message": "Access denied due to missing subscription key. Make sure to include subscription key when making requests to an API."
}

Answer 1

Hi @LuLaCeK,

To resolve the issue of the Ocp-Apim-Subscription-Key not being recognized, ensure its correctly configured in the inbound policy. If the GET method works when you manually add the header in Postman, the backend is set up properly. Check that the set-header policy in the APIM is correctly configured and verify there are no conflicting hard-coded values. Use the APIM inspector to confirm the key is sent to the backend as expected. Test with different clients like cURL or Postman to see if the issue is environment-specific. Finally, ensure the subscription linked to the key is active and valid in the APIM Developer portal.

For further clarification, please refer to the following documentations: Document1, Document2

I hope this helps resolve your issue. Feel free to reach out if you have further concerns.