[_mikz]

You can write Lua middleware to do the Auth if you want. The traffic monitor website is protected by us, but the actual proxy is not authenticated as it could interfere with API you are using.

[jrochkind1]

Huh, so using this service will turn any authenticated API into an open api, usable by anyone that knows the URL?

That seems... unsuitable for most non-public apis.

[_mikz]

It is a proxy, so if you don't explicitly add keys with a middleware the API will still need the auth.

But you can do key mapping: if you pass your key it will transform it to the real one and if not, then it will just return 403.