Consuming an API Key-protected API

API Key authentication is the simplest inbound authentication method on APEX. It is suitable for read-only, non-sensitive APIs.

Before continuing, ensure you have:

1. Created an application
2. Generated an API key
3. Subscribed to the API

Making the API call

Pass your API key in the x-apex-apikey request header on every call.

GET /agency/api
Host: public.api.gov.sg
x-apex-apikey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxCopy to clipboardErrorCopied

That’s it — no additional token generation is required.

The API publisher may also allow the API key to be passed as a query parameter. Check with the publisher if you are unsure of the expected format.

Key rotation

API keys are long-lived and should be rotated periodically to reduce the risk of exposure. To rotate a key:

1. Generate a new API key from your application in the APEX Portal.
2. Update your application to use the new key.
3. Deactivate the old key once it is no longer in use.