mcp-server: default ApiKeyAuthenticationConverter

Signed-off-by: Daniel Garnier-Moiroux <[email protected]>

Author: Kehrlann

mcp-server-security/src/main/java/org/springaicommunity/mcp/security/server/apikey/web/ApiKeyAuthenticationConverter.java

@@ -37,6 +37,12 @@ public class ApiKeyAuthenticationConverter implements AuthenticationConverter {
 
 	private final String apiKeyHeaderName;
 
+	public static final String DEFAULT_API_KEY_HEADER = "X-API-Key";
+
+	public ApiKeyAuthenticationConverter() {
+		this.apiKeyHeaderName = DEFAULT_API_KEY_HEADER;
+	}
+
 	public ApiKeyAuthenticationConverter(String apiKeyHeaderName) {
 		Assert.hasText(apiKeyHeaderName, "apiKeyHeaderName cannot be blank");
 		this.apiKeyHeaderName = apiKeyHeaderName;

mcp-server-security/src/test/java/org/springaicommunity/mcp/security/server/apikey/web/ApiKeyAuthenticationConverterTests.java

@@ -26,6 +26,21 @@ void convertExtractsApiKey() {
 		assertThat(apiKey.getCredentials().getSecret()).isEqualTo("my-secret");
 	}
 
+	@Test
+	void convertDefaultHeaderExtractsApiKey() {
+		var request = new MockHttpServletRequest();
+		request.addHeader("x-api-key", "api01.my-secret");
+
+		var converter = new ApiKeyAuthenticationConverter();
+		var authentication = converter.convert(request);
+		assertThat(authentication).isInstanceOf(ApiKeyAuthenticationToken.class);
+		var apiKey = (ApiKeyAuthenticationToken) authentication;
+		assertThat(apiKey.isAuthenticated()).isFalse();
+		assertThat(apiKey.getPrincipal()).isNull();
+		assertThat(apiKey.getCredentials().getId()).isEqualTo("api01");
+		assertThat(apiKey.getCredentials().getSecret()).isEqualTo("my-secret");
+	}
+
 	@Test
 	void convertWhenNoHeaderReturnsNull() {
 		var request = new MockHttpServletRequest();