# Require API Key On Websockets API

**URL:** <https://forum.serverless.com/t/require-api-key-on-websockets-api/19042>\
**Category:** Serverless Framework\
**Tags:** aws, lambda, security\
**Created:** [June 27, 2023, 7:32pm UTC](https://forum.serverless.com/t/require-api-key-on-websockets-api/19042 "2023-06-27T19:32:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicks6853](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/nicks6853/32/6662_2.png) [@nicks6853](https://forum.serverless.com/u/nicks6853)\
**Post date:** [June 27, 2023, 7:32pm UTC](https://forum.serverless.com/t/require-api-key-on-websockets-api/19042/1 "2023-06-27T19:32:50Z")

</div>

I was wondering how one can make API Keys required on a Websockets API. Does serverless framework support that, if not, is there a way to make it required?

Seems like `private: true` doesn’t work for websocket events.

---

<div class="post-metadata">

**Author:** ![beenmeckel](https://avatars.discourse-cdn.com/v4/letter/b/8dc957/32.png) [@beenmeckel](https://forum.serverless.com/u/beenmeckel)\
**Post date:** [August 29, 2024, 11:00pm UTC](https://forum.serverless.com/t/require-api-key-on-websockets-api/19042/2 "2024-08-29T23:00:08Z")

</div>

You simply do not send the secret to the frontend. In my case, we use Java Spring Boot as a backend to our React applications.

For external APIs to which we need authentication, these requests go frontend → backend → external and back. The authentication is only added in the backend. [snaptube](https://snaptube.cam/)[vidmate](https://vidmate.bid/)