Kong: key-auth turns a Route into an authenticated one

curl -X POST http://localhost:8001/routes/billing-route/plugins \
  --data name=key-auth \
  --data 'config.key_names[]=apikey'

curl -X POST http://localhost:8001/consumers --data username=acme

curl -X POST http://localhost:8001/consumers/acme/key-auth \
  --data key=acme-secret-key

curl -i http://localhost:8000/billing -H 'apikey: acme-secret-key'

No key:
  HTTP/1.1 401 Unauthorized
  {"message":"No API key found in request"}

Valid key:
  HTTP/1.1 200 OK
  X-Consumer-Id: 7c9e...
  X-Consumer-Username: acme

# Kong sends the X-Consumer-* headers to your upstream, so the service can
# know who called without parsing the credential itself.