Function extractKey

core/http/auth/middleware.go:510–536

extractKey extracts an API key from the request (all sources).

(c echo.Context)

// extractKey extracts an API key from the request (all sources).
func extractKey(c echo.Context) string {
	// Authorization header
	auth := c.Request().Header.Get("Authorization")
	if strings.HasPrefix(auth, "Bearer ") {
		return strings.TrimPrefix(auth, "Bearer ")
	}
	if auth != "" {
		return auth
	}

	// x-api-key
	if key := c.Request().Header.Get("x-api-key"); key != "" {
		return key
	}

	// xi-api-key
	if key := c.Request().Header.Get("xi-api-key"); key != "" {
		return key
	}

	// token cookie
	if cookie, err := c.Cookie("token"); err == nil && cookie.Value != "" {
		return cookie.Value
	}

	return ""
}

// isValidLegacyKey checks if the key matches any configured API key
// using constant-time comparison to prevent timing attacks.