Struct ApiKeyAuthInterceptor 

pub struct ApiKeyAuthInterceptor { /* private fields */ }

Rejects requests whose API-key header is absent or not in the allowed set.

The header name defaults to x-api-key (matched case-insensitively, as all header keys in CallContext are lowercased) and is configurable via with_header.

Implementations

impl ApiKeyAuthInterceptor

pub fn new<I, S>(keys: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Creates an interceptor accepting any of the given keys on the default x-api-key header.

pub fn with_labelled_keys<I, K, L>(entries: I) -> Self

where I: IntoIterator<Item = (K, L)>, K: Into<String>, L: Into<String>,

Creates an interceptor whose keys each name the caller they belong to.

The label becomes CallContext::caller_identity, which is what RateLimitInterceptor keys a budget on. Without labels every holder of a valid key shares the "anonymous" bucket, so one noisy client spends everyone’s budget — per-caller rate limiting that is not per-caller.

The label is deliberately not derived from the key. A caller key is written to a rate-limit table that may be shared across replicas, and can reach logs and metrics; a credential should be in none of those. Naming the callers keeps the secret out of all of them.

Example

use a2a_protocol_server::ApiKeyAuthInterceptor;

let auth = ApiKeyAuthInterceptor::with_labelled_keys([
    ("key-for-acme", "acme"),
    ("key-for-globex", "globex"),
]);

pub fn with_header(self, header_name: impl Into<String>) -> Self

Sets the header name to read the key from (lowercased automatically).

Trait Implementations

impl Debug for ApiKeyAuthInterceptor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerInterceptor for ApiKeyAuthInterceptor

fn before<'a>( &'a self, ctx: &'a CallContext, ) -> Pin<Box<dyn Future<Output = A2aResult<()>> + Send + 'a>>

Called before the request handler processes the method call.

fn after<'a>( &'a self, _ctx: &'a CallContext, ) -> Pin<Box<dyn Future<Output = A2aResult<()>> + Send + 'a>>

Called after the request handler has finished processing.

fn authenticates(&self) -> bool

Returns true if this interceptor authenticates requests — i.e. its before hook rejects callers that do not present valid credentials.