Skip to main content
Feedback

Prerequisites for using Secure Hash (SHA-256 or MD5) authenticated GraphQL I/O Doc

To successfully test the Secure Hash (SHA-256 or MD5) authenticated GraphQL API on the Developer Portal > I/O Doc section, ensure you have completed the following setup on Cloud API Management (Control Center):

  1. Created an API definition with a resource endpoint configured as a GraphQL endpoint:

    You must create an API definition with a resource endpoint, and configure it as a GraphQL endpoint on Control Center.

  2. Configured Key & Method Detection:

    info

    The setup steps for SHA-256- and MD5-authenticated GraphQL I/O Docs are identical. The only difference is the Request Authentication Type selected on the Key & Method Detection page - Key + Secret + Timestamp Hash (SHA-256) or Key + Secret + Timestamp Hash (MD5).

    You must configure the following authentication fields on the Key & Method Detection page:

    • Request Authentication Type:

      1. If you are using SHA-256 authentication, select Key + Secret + Timestamp Hash (SHA-256).
      2. If you are using MD5 authentication, select Key + Secret + Timestamp Hash (MD5).

    • Developer's API Key Location: Select Header, Parameters, or Path

    • Key Field Identifier: Specifies how the Traffic Manager identifies the API key in the request, depending on the Developer's API Key Location.

      • If Developer's API Key Location is set to Header or Parameters, enter api_key as the name of the key field.

      • If Developer's API Key Location is set to Path, enter a number that represents the position of the API key in the public endpoint path.

        note

        The value entered in this field determines the public endpoint path value on the Domains & Traffic Routing page.

    Based on these settings, the location where the API key is sent in the request differs depending on the key location selected - Header, Parameters, or Path. Refer to the Secure Hash (SHA-256 or MD5) Authenticated GraphQL I/O Doc Usage Reference for more information.

  3. (Conditional) Configured Domains & Traffic Routing:

    You must configure the public domain address and endpoint path on the Domains & Traffic Routing page only when the Developer's API Key Location is set to Path on the Key & Method Detection page.

    • In the Customize your Public Endpoint Address first text box, enter your public domain address, and in the second text box, enter 303/{api_key} as the public endpoint path. Here {api_key} is a placeholder at the position matching the Key Field Identifier value set on the Key & Method Detection page.

    • In the Your Endpoint Address first text box, enter your backend domain address, and in the second text box, enter the endpoint path.

  4. Configured endpoint CORS settings:

    You must configure the following CORS fields to enable browser-based requests on the Endpoint Cross-Origin Resource Sharing page:

    • Enable CORS: Enable this toggle switch.
    • Allow CORS Requests from any domain: Enable this toggle switch.
    • Sub-domain matching allowed?: Enable this toggle switch.
    • List of headers allowed: Provide api_key, content-type
    • Are cookies allowed?: By default, this is disabled. Keep it disabled.

  5. Created a GraphQL I/O Doc and provided access to it:

    You must create a GraphQL Interactive Documentation item on the Control Center Interactive Documentation page and provided access to it on the API Definition Interactive Documentation Access Control page.

  6. Created Package, Plan, Application, and generated credentials:

    • You must have created an API Package, added an API Plan, and linked your GraphQL API definition and GraphQL endpoint to a plan on the Control Center.

    • You must have enabled Generate Shared Secrets on the API Package Key Properties page.

    • You must have obtained your application's API key and secret from the Developer Portal. Sign in, click My Account > My Applications, find your registered application, and click View Keys. This API key and shared secret will be used for testing the GraphQL I/O Doc.

Next Steps

Once setup is complete, test your GraphQL API on the Developer Portal using your application's API key and shared secret. Refer to Leveraging your GraphQL API Interactive Documentation.

On this Page