3. Security and Validation

Deprecated: Set the expression directly on the apiKey plugin.

expressionExtractor

Extracts an API key by evaluating an expression on the incoming request. The result (a string) is treated as the API key. The expression is evaluated in the configured language (default: SPEL) during the request flow.

Typical usage inside <apiKey>:

<apiKey>
   <expressionExtractor
       language="SPEL"
       expression="request.headers['X-Api-Key']"/>
 </apiKey>

If the expression evaluates to null or an empty string, no key is extracted.


Can be used in:

apiKey