Secure "hello world" Google cloud function

Question

I need a very secure cloud function so I'm trying to put it behind a API Gateway. The function works fine when I call it directy passing a Bearer token in header:

https://us-central1-<my-project>.cloudfunctions.net/<my-hello-function>

However I want to allow it to be used with a API token thru API Gateway (and then do something more useful than saying "hello"):

https://my-gateway-xxxxxxxx.uc.gateway.dev/v1/stats&key=<my-API-token>

When I try to call it I get:

{ "code": 404, "message": "Path does not match any requirement URI template." }

My API Gateway config file:

swagger: "2.0"
info:
  title: my-gateway
  version: "1.0.0"
basePath: "/v1"
schemes:
 - "https"
produces:
 - application/json
paths:
  /stats:
    get:
      tags:
      - "stats"
      summary: "get service stats"
      description: "Returns statistics"
      operationId: "hello_world"
      #produces:
      #- "application/json"
      parameters:
      - name: "since"
        in: "header"
        description: "Date to retrieve information"
        required: false
        type: "string"
        format: "date"
      x-google-backend:
          address: https://us-central1-<my-project>.cloudfunctions.net/<my-hello-function>
          path_translation: CONSTANT_ADDRESS
          protocol: h2
      responses:
        "200":
          description: "successful operation"
          schema:
            $ref: "#"
        "400":
          description: "Invalid datetime supplied"
        "404":
          description: "Unknown path"
      security:
      - api_key: []
securityDefinitions:
  api_key:
    type: "apiKey"
    name: "api_key"
    in: "query"
definitions:
  ApiResponse:
    type: "object"
    properties:
      code:
        type: "integer"
        format: "int32"
      type:
        type: "string"
      message:
        type: "string"

What's missing? What am I doing wrong?

Answer 1

I tested your file and I reviewed your HTTP call. I noticed that in your security definitions you are naming the API key as api_key but in your URL you are using the parameter key, also, it is not necessary to set path_translation: CONSTANT_ADDRESS because this is the default directive

Additionally, you can check if your gateway is using the latest configuration.

This is the config that I used and works as expected (I changed the apikey to key and I removed path_translation)

swagger: "2.0"
info:
  title: my-gateway
  version: "1.0.0"
basePath: "/v1"
schemes:
 - "https"
produces:
 - application/json
paths:
  /stats:
    get:
      tags:
      - "stats"
      summary: "get service stats"
      description: "Returns statistics"
      operationId: "hello_world"
      parameters:
      - name: "since"
        in: "header"
        description: "Date to retrieve information"
        required: false
        type: "string"
        format: "date"
      x-google-backend:
          address: https://us-central1-[myproject].cloudfunctions.net/[functionname]
          protocol: h2
      responses:
        "200":
          description: "successful operation"
          schema:
            $ref: "#"
        "400":
          description: "Invalid datetime supplied"
        "404":
          description: "Unknown path"
      security:
      - api_key: []
securityDefinitions:
  api_key:
    type: "apiKey"
    name: "key"
    in: "query"
definitions:
  ApiResponse:
    type: "object"
    properties:
      code:
        type: "integer"
        format: "int32"
      type:
        type: "string"
      message:
        type: "string"