title: Google Cloud Endpoints pass API key in header
body: <p>According to <a href="https://cloud.google.com/endpoints/docs/openapi/authentication-method#api_keys" rel="nofollow noreferrer">Cloud Endpoint docs</a>, it seems like you have to pass the API key in the URL itself as a query parameter.</p>
  
  <p>However, that makes us vulnerable to man in the middle attacks. I was wondering if there was a way to have it work by passing the API key in the header instead.</p>
  
  <p>I am working on a simple app which does not have any sign-in methods integrated already. Is there any alternative way of authentication in Cloud Endpoints where I am not required to add any existing sign-in method but will be able to use API keys securely.</p>