NoClientKey
in package
FinalYes
Marks an external Api action called by a third party, not by a partner application.
Such callers cannot send the application key (X-API-Key), so the action does not require
it. Typical cases are payment gateway and SMS aggregator callbacks and the app
deauthorization callback of an OAuth provider.
Authorization is unchanged: the action still passes the JWT guard and the RBAC gate (usually as a guest), and security rests on its own verification (gateway signature, payment check at the provider).
IMPORTANT: every new use is a deliberate decision. The list is kept in ApiClientKeyExemptionTest; an action missing there fails the test.
Attributes
- #[Attribute]
- \Attribute::TARGET_METHOD