# Private function doesn't require API key when deployed

**URL:** <https://forum.serverless.com/t/private-function-doesnt-require-api-key-when-deployed/2465>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [August 9, 2017, 9:59pm UTC](https://forum.serverless.com/t/private-function-doesnt-require-api-key-when-deployed/2465 "2017-08-09T21:59:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ath0](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/ath0/32/862_2.png) [@ath0](https://forum.serverless.com/u/ath0)\
**Post date:** [August 9, 2017, 9:59pm UTC](https://forum.serverless.com/t/private-function-doesnt-require-api-key-when-deployed/2465/1 "2017-08-09T21:59:42Z")

</div>

When I define a function as private and also define an API key in serverless.yml, the deployed API Gateway method entry appears with “API Key Required” still set to false.

For example:

> ```
> functions:
> SomeFunction:
> handler: SomeFunc.handler
> private: true
> events:
> - http:
> path: v1/somefunc
> method: get
> 
> ```

Bug or am I missing something?

---

<div class="post-metadata">

**Author:** ![bfieber](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bfieber/32/653_2.png) [@bfieber](https://forum.serverless.com/u/bfieber)\
**Post date:** [August 9, 2017, 10:07pm UTC](https://forum.serverless.com/t/private-function-doesnt-require-api-key-when-deployed/2465/2 "2017-08-09T22:07:57Z")

</div>

Per the [Serverless API Gateway docs](https://serverless.com/framework/docs/providers/aws/events/apigateway/)  
You need to move the private property to the http event like so:

```auto
functions:
  SomeFunction:
    handler: SomeFunc.handler
    events:
      - http:
          path: v1/somefunc
          method: get
          private: true

```

Hope it helps.