Azure APIM Subscription Keys

Overview (Simple Explanation)

Azure API Management (APIM) uses subscription keys to identify clients and control access to APIs. Every request to a protected API must include a subscription key.

APIM subscription responsibilities:

• Authenticate requests using subscription keys
• Enforce product access and usage limits
• Monitor API consumption

Step 1: Create a Product in APIM

Products group APIs and control access via subscription keys.

1. Azure Portal → API Management instance → Products
2. Click Add Product
3. Name: My-API-Product
4. Set approval required: Yes/No depending on access policy
5. Save the product

Step 2: Add APIs to Product

Associate your APIs with the product so subscription keys can access them.

1. Go to the Product → APIs tab → Add APIs
2. Select the APIs you want included
3. Save changes

Step 3: Create or Assign Subscription Keys

Subscription keys can be auto-generated or manually assigned to users or groups.

1. Go to Product → Subscriptions
2. Click Add Subscription
3. Provide name, owner (user/group), and optional primary/secondary keys
4. Save subscription

Step 4: Call API Using Subscription Key

Include the subscription key in the request header or query string.

// Using header
GET https://<apim-name>.azure-api.net/myapi/endpoint
Ocp-Apim-Subscription-Key: <subscription-key>

// Using query string
GET https://<apim-name>.azure-api.net/myapi/endpoint?subscription-key=<subscription-key>

Step 5: Monitor & Manage Subscription Keys

• Check usage and quotas for each subscription
• Regenerate primary or secondary keys if compromised
• Enable or disable subscriptions as needed
• Track consumption in APIM Analytics

Final Understanding (One Line)

Subscription keys in APIM control access → Associate APIs with products → Monitor usage and enforce quotas.