Skip to main content

API Key Authentication

The notification HTTP endpoints use API key validation rather than JWT bearer tokens. This is because the endpoints are designed for machine-to-machine communication — called by other services in the platform, not by end users.

How It Works​

  1. The caller includes the API key in the x-api-key HTTP header
  2. The function validates the key against the configured value
  3. If the key is invalid or missing, the function returns 401 Unauthorized

Configuration​

The API key is stored in Azure App Configuration with a Key Vault reference, ensuring the secret is never stored in plain text or source code.

Why Not JWT?​

JWT authentication requires an identity provider (Entra ID) and a user context. For service-to-service calls within the platform, API key authentication is simpler and doesn't require token acquisition flows.