Skip to content
Weik.ioDocs
2026.1
Try Weik.io

This page describes Weik.io 2026.1, and the current release is 2026.2. Read this topic for 2026.2

API Subscriptions

Weik.io 2026.1

Manage API access and authentication with subscriptions.

On this page

API Subscriptions control which clients can access your APIs and how they authenticate.

Configuration#

At a minimum, a subscription defines which APIs it grants access to.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: mobile-app-subscription
  description: Subscription for mobile application
spec:
  apis:
    - users-api
    - orders-api
  isActive: true
  parameters:
    key: "your-api-key"

Properties#

Property Type Required Description
apis string[] Yes List of API names this subscription grants access to
isActive bool No Whether the subscription is active (default: true)
parameters object No Authentication and configuration parameters
additionalHeaders object No HTTP headers to include in requests
variables object No Variables specific to this subscription

Authentication examples#

The authentication method is determined by the category field in the metadata. The following examples show common configurations.

API key#

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: my-apikey
  category: apikey
spec:
  apis:
    - petstore
  isActive: true
  parameters:
    key: "NGWdkceFPYyXmaH15jS3K0uCsk7KnnPA"

Basic authentication#

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: dev-basicauth
  category: basic
spec:
  apis:
    - petstore
  isActive: true
  parameters:
    username: "hello"
    password: "test123"

OpenID Connect#

If your APIs use an identity provider such as Entra ID, Keycloak, or Auth0, use OIDC to validate tokens.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: oidc-aad
  category: oidc
spec:
  apis:
    - petstore
  isActive: true
  parameters:
    issuer: "https://sts.windows.net/37e55da6-fb62-456a-8d8e-f6f5b649092f/"
    audience: "api://f2f62be5-bc3a-4786-b42c-209a4e0f22bb"
  additionalHeaders:
    custom-source: 'entra'
    anotherdata: 'More header data for this subscription'

Anonymous#

To allow unauthenticated access, declare it explicitly with the anonymous category.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: anonymous-apis
  category: anonymous
spec:
  apis:
    - webhook
  isActive: true

Additional headers#

If you define additionalHeaders, the proxy injects them into every request that passes through this subscription. This is useful for tagging requests with tenant IDs or tracking sources without requiring the client to send them.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: partner-subscription
spec:
  apis:
    - partner-api
  isActive: true
  additionalHeaders:
    X-Partner-Id: partner-123
    X-Request-Source: partner-portal

Variables#

Avoid hardcoding secrets such as API keys in YAML files. Use variables to read them from the environment or a secure store instead.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: partner-subscription
spec:
  apis:
    - partner-api
  isActive: true
  parameters:
    apiKey: "{{apiKey}}"
  variables:
    apiKey: "{{sys:PARTNER_API_KEY}}"

See Using Variables for details on variable resolution.

Next steps#