How to mask or hide OCP apim subscription key from being displayed in azure portal

Question

Can we hide/mask OCP apim subscription key which is called from KeyVault to display in azure portal apim policies.

Answer 1

Hi @Nagender Tipparna , I haven't tested it but you should be able to hide/mask the OCP APIM subscription key in Azure portal APIM policies by using named values. Named values are a way to store and reference values in your APIM policies without exposing them in plain text.

Here are the high-level steps to use named values to hide/mask the OCP APIM subscription key:

1. Create a named value for the OCP APIM subscription key in your APIM instance.
2. Store the OCP APIM subscription key in Azure Key Vault.
3. Reference the named value in your APIM policies instead of the OCP APIM subscription key.

Here's an example policy that shows how to use named values to reference the OCP APIM subscription key:

<policies>
    <inbound>
        <base />
        <set-header name="Ocp-Apim-Subscription-Key" exists-action="override">
            <value>@{
                var keyVaultUri = "https://your-key-vault-name.vault.azure.net/";
                var secretName = "your-secret-name";
                var secretVersion = "your-secret-version";
                var secretUri = $"{keyVaultUri}secrets/{secretName}/{secretVersion}";
                var secretValue = await context.Backend.SendAsync(new HttpRequestMessage(HttpMethod.Get, secretUri));
                return $"{{{{named-value:{secretValue.Content.ReadAsStringAsync().Result}}}}}";
            }</value>
        </set-header>
			...

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James