ApiKey L2 construct

An API Gateway ApiKey.

An ApiKey can be distributed to API clients that are executing requests for Method resources that require an Api Key.

CloudFormation: AWS::ApiGateway::ApiKey
L1 type: CfnApiKey
Source: aws-apigateway/lib/api-key.ts
Type last changed: v2.227.0 · 21 Nov 2025

Example

const stack = new Stack(app, 'my-stack', {});
new api.ApiKey(stack, 'my-api-key', {
  enabled: false,
});

python

stack = Stack(app, "my-stack")
api.ApiKey(stack, "my-api-key",
    enabled=False
)

java

Stack stack = Stack.Builder.create(app, "my-stack").build();
ApiKey.Builder.create(stack, "my-api-key")
        .enabled(false)
        .build();

csharp

// Install: dotnet add package Amazon.CDK.Lib
var stack = new Stack(app, "my-stack", new StackProps { });
new ApiKey(stack, "my-api-key", new ApiKeyProps {
    Enabled = false
});

// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
stack := awscdk.NewStack(app, jsii.String("my-stack"), &StackProps{
})
api.NewApiKey(stack, jsii.String("my-api-key"), &ApiKeyProps{
	Enabled: jsii.Boolean(false),
})

Initializer

new ApiKey(scope: Construct, id: string, props?: ApiKeyProps)

python

ApiKey(scope: Construct, id: str, props: typing.Optional[ApiKeyProps] = None)

java

new ApiKey(Construct scope, String id, ApiKeyProps props)

csharp

new ApiKey(Construct scope, string id, ApiKeyProps? props = null)

NewApiKey(Scope Construct, Id *string, Props ApiKeyProps)

Construct Props

apiKeyNamestringapi_key_namestrapiKeyNameStringApiKeyNamestringApiKeyName*string= automically generated name#

A name for the API key.

If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the API key name.

customerIdstringcustomer_idstrcustomerIdStringCustomerIdstringCustomerId*string= none#

An AWS Marketplace customer identifier to use when integrating with the AWS SaaS Marketplace.

defaultCorsPreflightOptionsCorsOptionsdefault_cors_preflight_optionsCorsOptionsdefaultCorsPreflightOptionsCorsOptionsDefaultCorsPreflightOptionsCorsOptionsDefaultCorsPreflightOptionsCorsOptions= CORS is disabled#

Adds a CORS preflight OPTIONS method to this resource and all child resources.

You can add CORS at the resource-level using addCorsPreflight.

defaultIntegrationIntegrationdefault_integrationIntegrationdefaultIntegrationIntegrationDefaultIntegrationIntegrationDefaultIntegrationIntegration= Inherited from parent.#

An integration to use as a default for all methods created within this API unless an integration is specified.

defaultMethodOptionsMethodOptionsdefault_method_optionsMethodOptionsdefaultMethodOptionsMethodOptionsDefaultMethodOptionsMethodOptionsDefaultMethodOptionsMethodOptions= Inherited from parent.#

Method options to use as a default for all methods created within this API unless custom options are specified.

descriptionstringdescriptionstrdescriptionStringDescriptionstringDescription*string= none#

A description of the purpose of the API key.

enabledbooleanenabledboolenabledBooleanEnabledboolEnabled*bool= true#

Indicates whether the API key can be used by clients.

generateDistinctIdbooleangenerate_distinct_idboolgenerateDistinctIdBooleanGenerateDistinctIdboolGenerateDistinctId*bool= false#

Specifies whether the key identifier is distinct from the created API key value.

resourcesIRestApi[]resourcestyping.List[IRestApi]resourcesList<IRestApi>ResourcesIRestApi[]Resources*[]IRestApi= nonedeprecated#

- use `stages` instead

stagesIStage[]stagestyping.List[IStage]stagesList<IStage>StagesIStage[]Stages*[]IStage= the api key is not associated wi…#

A list of Stages this api key is associated with.

default

Default: the api key is not associated with any stages

valuestringvaluestrvalueStringValuestringValue*string= none#

The value of the API key.

Must be at least 20 characters long.

Properties

apiKeyRefApiKeyReferenceapi_key_refApiKeyReferenceapiKeyRefApiKeyReferenceApiKeyRefApiKeyReferenceApiKeyRefApiKeyReferencerequired#

A reference to a ApiKey resource.

envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironmentrequired#

The environment this resource belongs to.

notes

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

grantsApiKeyGrantsgrantsApiKeyGrantsgrantsApiKeyGrantsGrantsApiKeyGrantsGrantsApiKeyGrantsrequired#

Collection of grant methods for an ApiKey.

keyArnstringkey_arnstrkeyArnStringKeyArnstringKeyArn*stringrequired#

The API key ARN.

keyIdstringkey_idstrkeyIdStringKeyIdstringKeyId*stringrequired#

The API key ID.

nodeNodenodeNodenodeNodeNodeNodeNodeNoderequired#

The tree node.

PROPERTY_INJECTION_IDstringproperty_injection_idstrPROPERTY_INJECTION_IDStringPROPERTY_INJECTION_IDstringPROPERTY_INJECTION_ID*stringrequiredstatic#

Uniquely identifies this class.

stackStackstackStackstackStackStackStackStackStackrequired#

The stack in which this resource is defined.

Methods

applyCrossStackReferenceStrength(strength: ReferenceStrength): voiddef apply_cross_stack_reference_strength(self, strength: ReferenceStrength) -> Nonepublic void applyCrossStackReferenceStrength(ReferenceStrength strength)public void ApplyCrossStackReferenceStrength(ReferenceStrength strength)func ApplyCrossStackReferenceStrength(Strength ReferenceStrength)#

Override the cross-stack reference strength for this resource.

notes · 1 parameter

When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.

Parameters

strengthstrengthstrengthstrengthStrength — - The reference strength to use for this resource.

applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#

Apply the given removal policy to this resource.

notes

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

fromApiKeyId(scope: Construct, id: string, apiKeyId: string): IApiKey@staticmethod def from_api_key_id(scope: Construct, id: str, api_key_id: str) -> IApiKeypublic static IApiKey fromApiKeyId(Construct scope, String id, String apiKeyId)public static IApiKey FromApiKeyId(Construct scope, string id, string apiKeyId)func FromApiKeyId(Scope Construct, Id *string, ApiKeyId *string) IApiKeystatic#

Import an ApiKey by its Id.

grantRead(grantee: IGrantable): Grantdef grant_read(self, grantee: IGrantable) -> Grantpublic Grant grantRead(IGrantable grantee)public Grant GrantRead(IGrantable grantee)func GrantRead(Grantee IGrantable) Grant#

Permits the IAM principal all read operations through this key.

The use of this method is discouraged. Please use grants.read() instead.

[disable-awslint:no-grants]

1 parameter

Parameters

granteegranteegranteegranteeGrantee — The principal to grant access to.

grantReadWrite(grantee: IGrantable): Grantdef grant_read_write(self, grantee: IGrantable) -> Grantpublic Grant grantReadWrite(IGrantable grantee)public Grant GrantReadWrite(IGrantable grantee)func GrantReadWrite(Grantee IGrantable) Grant#

Permits the IAM principal all read and write operations through this key.

The use of this method is discouraged. Please use grants.readWrite() instead.

[disable-awslint:no-grants]

1 parameter

Parameters

granteegranteegranteegranteeGrantee — The principal to grant access to.

grantWrite(grantee: IGrantable): Grantdef grant_write(self, grantee: IGrantable) -> Grantpublic Grant grantWrite(IGrantable grantee)public Grant GrantWrite(IGrantable grantee)func GrantWrite(Grantee IGrantable) Grant#

Permits the IAM principal all write operations through this key.

The use of this method is discouraged. Please use grants.write() instead.

[disable-awslint:no-grants]

1 parameter

Parameters

granteegranteegranteegranteeGrantee — The principal to grant access to.

isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#

Checks if `x` is a construct.

notes · 1 parameter · returns

Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.

Parameters

xxxxX — Any object.

Returns: true if x is an object created from a class which extends Construct.

isOwnedResource(construct: IConstruct): boolean@staticmethod def is_owned_resource(construct: IConstruct) -> boolpublic static Boolean isOwnedResource(IConstruct construct)public static bool IsOwnedResource(IConstruct construct)func IsOwnedResource(Construct IConstruct) *boolstatic#

Returns true if the construct was created by CDK, and false otherwise.

isResource(construct: IConstruct): boolean@staticmethod def is_resource(construct: IConstruct) -> boolpublic static Boolean isResource(IConstruct construct)public static bool IsResource(IConstruct construct)func IsResource(Construct IConstruct) *boolstatic#

Check whether the given construct is a Resource.

toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#

Returns a string representation of this construct.

with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.

ApiKey L2 construct ​

Example ​

Initializer ​

Construct Props ​

Properties ​

Methods ​

ApiKey L2 construct

Example

Initializer

Construct Props

Properties

Methods