The API key is provided for every request and is passed as a query string use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use .