SPEL) during the request flow.
Typical usage inside <apiKey>:
<apiKey>
<expressionExtractor
language="SPEL"
expression="request.headers['X-Api-Key']"/>
</apiKey>
If the expression evaluates to null or an empty string, no key is extracted.