AWS - API keys available on the Serverless Offline framework?

Question

I use Serverless Offline to develop a Web project.

I need of API Keys to access to resource on Serverless AWS Lamda.

I have a serverless.yml with my service and my provider.

In Postman, I access to my route (http://127.0.0.1:3333/segments/UUID/test), and I haven't any error (as Forbidden message), the Lambda is executed...

test:
  handler: src/Api/segment.test
  events:
    - http:
        path: segments/{segmentUuid}/test
        method: post
        request:
          parameters:
            paths:
              segmentUuid: true
        private: true

The route in question is not protected by private.

Answer 1

https://www.npmjs.com/package/serverless-offline#token-authorizers

Serverless-offline will emulate the behaviour of APIG and create a random token that's printed on the screen. With this token you can access your private methods adding x-api-key: generatedToken to your request header. All api keys will share the same token. To specify a custom token use the --apiKey cli option.

Command will look like this:

sls offline --apiKey any-pregenerated-key

Answer 2

Given latest changes this configuration worked for me with serverless offline:

  provider: {
    name: 'aws',
    region: region,
    runtime: 'nodejs14.x',
    stage: stage,
    apiGateway:{
      apiKeys: [{
        name: 'test name',
        value: 'sadasfasdasdasdasdafasdasasd'
      }],
    },
  },

https://github.com/dherault/serverless-offline/issues/963

Answer 3

For local dev use this inside serverless.yml:

custom:
  serverless-offline:
    apiKey: 'your-key-here'

Or this inside serverless.ts:

 custom: {
    'serverless-offline': {
      apiKey: 'your-key-here',
    },
  },

Answer 4

serverless-offline removed --apiKey as a cli parameter as part of v11.0.0. The documentation on https://www.serverless.com/plugins/serverless-offline is currently out of date, "To specify a custom token use the --apiKey cli option." needs to be removed.

MIGRATION: if you want to specify the apiKey value yourself, please define it under provider.apiGateway.apiKeys in the serverless config

There's a discussion occurring in issue issues/1608; dnalborczyk's response should provide more insight: https://github.com/dherault/serverless-offline/issues/1608#issuecomment-1306200311.