title: Spring Security Resource Server and API Key Support
body: <p>I have a spring boot API that has the resource server configuration to validate the authorization token and it is working correctly.</p>
  <p>I would like to add support to handle an <strong>API_KEY</strong> using an http request header as an alternative authentication method.</p>
  <p>I have the following code in my spring security configuration.</p>
  <pre class="lang-java prettyprint-override"><code>    @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.cors().and().authorizeRequests(authz -&gt; authz
                  .antMatchers(HttpMethod.OPTIONS, &quot;/**&quot;).permitAll()
                  .antMatchers(&quot;/actuator/**&quot;).permitAll()
                  .antMatchers(&quot;/callback/v1/**&quot;).permitAll()
                  .antMatchers(&quot;/doc&quot;).permitAll()
                  )
                  .oauth2ResourceServer(oauth2 -&gt; oauth2.jwt());
  
      }
  </code></pre>
  <p>What is the best way to achieve this so I can have both authentication options for my API?</p>