app.get('/api/v1/orders/:orderId', (req, res) => {
  try {
    const order = orderService.getOrder(req.params.orderId);
    
    if (!order) {
      return res.status(404).json({
        type: 'https://api.example.com/errors/not-found',
        title: 'Order Not Found',
        status: 404,
        detail: `Order ${req.params.orderId} does not exist`,
      });
    }
    
    res.set('Cache-Control', 'public, max-age=300');
    res.status(200).json(order);
  } catch (error) {
    res.status(500).json(createErrorResponse(error));
  }
});

@GetMapping("/api/v1/orders/{orderId}")
public ResponseEntity<?> getOrder(@PathVariable String orderId) {
    try {
        Order order = orderService.getOrder(orderId);
        if (order == null) {
            return ResponseEntity.status(404).body(Map.of(
                "type", "https://api.example.com/errors/not-found",
                "title", "Order Not Found",
                "status", 404,
                "detail", "Order " + orderId + " does not exist"
            ));
        }
        return ResponseEntity.ok()
            .header("Cache-Control", "public, max-age=300")
            .body(order);
    } catch (Exception e) {
        return ResponseEntity.status(500).body(createErrorResponse(e));
    }
}

from fastapi import APIRouter
from fastapi.responses import JSONResponse

router = APIRouter()

@router.get("/api/v1/orders/{order_id}")
async def get_order(order_id: str):
    try:
        order = order_service.get_order(order_id)
        if order is None:
            return JSONResponse(status_code=404, content={
                "type": "https://api.example.com/errors/not-found",
                "title": "Order Not Found",
                "status": 404,
                "detail": f"Order {order_id} does not exist",
            })
        return JSONResponse(
            status_code=200,
            content=order.dict(),
            headers={"Cache-Control": "public, max-age=300"},
        )
    except Exception as e:
        return JSONResponse(status_code=500, content=create_error_response(e))

[HttpGet("api/v1/orders/{orderId}")]
public async Task<IActionResult> GetOrder(string orderId)
{
    try
    {
        var order = await _orderService.GetOrderAsync(orderId);
        if (order == null)
        {
            return NotFound(new
            {
                type = "https://api.example.com/errors/not-found",
                title = "Order Not Found",
                status = 404,
                detail = $"Order {orderId} does not exist"
            });
        }
        Response.Headers.CacheControl = "public, max-age=300";
        return Ok(order);
    }
    catch (Exception e)
    {
        return StatusCode(500, CreateErrorResponse(e));
    }
}

app.post('/api/v1/orders', (req, res) => {
  try {
    const { userId, items, shippingAddress } = req.body;
    
    // Validate request
    const validation = validateOrderRequest({ userId, items, shippingAddress });
    if (!validation.valid) {
      return res.status(400).json({
        type: 'https://api.example.com/errors/validation-error',
        title: 'Validation Failed',
        status: 400,
        detail: validation.errors.join('; '),
        instance: req.path,
      });
    }
    
    // Create order (may fail with conflict)
    const newOrder = await orderService.createOrder(userId, items, shippingAddress);
    
    // Return 201 Created with Location header
    res
      .status(201)
      .set('Location', `/api/v1/orders/${newOrder.id}`)
      .json(newOrder);
  } catch (error) {
    if (error instanceof ConflictError) {
      return res.status(409).json({
        type: 'https://api.example.com/errors/conflict',
        title: 'Conflict',
        status: 409,
        detail: error.message,
      });
    }
    res.status(500).json(createErrorResponse(error));
  }
});

@PostMapping("/api/v1/orders")
public ResponseEntity<?> createOrder(@RequestBody CreateOrderRequest body) {
    try {
        // Validate request
        ValidationResult validation = validateOrderRequest(body);
        if (!validation.isValid()) {
            return ResponseEntity.status(400).body(Map.of(
                "type", "https://api.example.com/errors/validation-error",
                "title", "Validation Failed",
                "status", 400,
                "detail", String.join("; ", validation.getErrors())
            ));
        }

        Order newOrder = orderService.createOrder(
            body.getUserId(), body.getItems(), body.getShippingAddress());

        return ResponseEntity.status(201)
            .header("Location", "/api/v1/orders/" + newOrder.getId())
            .body(newOrder);
    } catch (ConflictException e) {
        return ResponseEntity.status(409).body(Map.of(
            "type", "https://api.example.com/errors/conflict",
            "title", "Conflict",
            "status", 409,
            "detail", e.getMessage()
        ));
    } catch (Exception e) {
        return ResponseEntity.status(500).body(createErrorResponse(e));
    }
}

from fastapi import APIRouter, Request
from fastapi.responses import JSONResponse
from pydantic import BaseModel

router = APIRouter()

class CreateOrderRequest(BaseModel):
    user_id: str
    items: list
    shipping_address: dict

@router.post("/api/v1/orders")
async def create_order(body: CreateOrderRequest, request: Request):
    try:
        validation = validate_order_request(body)
        if not validation.valid:
            return JSONResponse(status_code=400, content={
                "type": "https://api.example.com/errors/validation-error",
                "title": "Validation Failed",
                "status": 400,
                "detail": "; ".join(validation.errors),
                "instance": str(request.url.path),
            })

        new_order = await order_service.create_order(
            body.user_id, body.items, body.shipping_address)

        return JSONResponse(
            status_code=201,
            content=new_order.dict(),
            headers={"Location": f"/api/v1/orders/{new_order.id}"},
        )
    except ConflictError as e:
        return JSONResponse(status_code=409, content={
            "type": "https://api.example.com/errors/conflict",
            "title": "Conflict",
            "status": 409,
            "detail": str(e),
        })
    except Exception as e:
        return JSONResponse(status_code=500, content=create_error_response(e))

[HttpPost("api/v1/orders")]
public async Task<IActionResult> CreateOrder([FromBody] CreateOrderRequest body)
{
    try
    {
        var validation = ValidateOrderRequest(body);
        if (!validation.Valid)
        {
            return BadRequest(new
            {
                type = "https://api.example.com/errors/validation-error",
                title = "Validation Failed",
                status = 400,
                detail = string.Join("; ", validation.Errors),
                instance = Request.Path.Value
            });
        }

        var newOrder = await _orderService.CreateOrderAsync(
            body.UserId, body.Items, body.ShippingAddress);

        Response.Headers.Location = $"/api/v1/orders/{newOrder.Id}";
        return StatusCode(201, newOrder);
    }
    catch (ConflictException e)
    {
        return Conflict(new
        {
            type = "https://api.example.com/errors/conflict",
            title = "Conflict",
            status = 409,
            detail = e.Message
        });
    }
    catch (Exception e)
    {
        return StatusCode(500, CreateErrorResponse(e));
    }
}

app.put('/api/v1/orders/:orderId', (req, res) => {
  try {
    const { items, shippingAddress, status } = req.body;
    
    // Validate complete resource
    const validation = validateCompleteOrder({ items, shippingAddress, status });
    if (!validation.valid) {
      return res.status(400).json({
        type: 'https://api.example.com/errors/validation-error',
        title: 'Invalid Order',
        status: 400,
        detail: validation.errors.join('; '),
      });
    }
    
    // PUT replaces entire resource; fail if missing required fields
    const updated = await orderService.replaceOrder(req.params.orderId, {
      items,
      shippingAddress,
      status,
    });
    
    if (!updated) {
      return res.status(404).json({
        type: 'https://api.example.com/errors/not-found',
        title: 'Order Not Found',
        status: 404,
        detail: `Order ${req.params.orderId} not found`,
      });
    }
    
    res.status(200).json(updated);
  } catch (error) {
    res.status(500).json(createErrorResponse(error));
  }
});

@PutMapping("/api/v1/orders/{orderId}")
public ResponseEntity<?> replaceOrder(
        @PathVariable String orderId,
        @RequestBody ReplaceOrderRequest body) {
    try {
        ValidationResult validation = validateCompleteOrder(body);
        if (!validation.isValid()) {
            return ResponseEntity.status(400).body(Map.of(
                "type", "https://api.example.com/errors/validation-error",
                "title", "Invalid Order",
                "status", 400,
                "detail", String.join("; ", validation.getErrors())
            ));
        }

        Order updated = orderService.replaceOrder(orderId, body);
        if (updated == null) {
            return ResponseEntity.status(404).body(Map.of(
                "type", "https://api.example.com/errors/not-found",
                "title", "Order Not Found",
                "status", 404,
                "detail", "Order " + orderId + " not found"
            ));
        }

        return ResponseEntity.ok(updated);
    } catch (Exception e) {
        return ResponseEntity.status(500).body(createErrorResponse(e));
    }
}

from fastapi import APIRouter
from fastapi.responses import JSONResponse
from pydantic import BaseModel

router = APIRouter()

class ReplaceOrderRequest(BaseModel):
    items: list
    shipping_address: dict
    status: str

@router.put("/api/v1/orders/{order_id}")
async def replace_order(order_id: str, body: ReplaceOrderRequest):
    try:
        validation = validate_complete_order(body)
        if not validation.valid:
            return JSONResponse(status_code=400, content={
                "type": "https://api.example.com/errors/validation-error",
                "title": "Invalid Order",
                "status": 400,
                "detail": "; ".join(validation.errors),
            })

        updated = await order_service.replace_order(order_id, body)
        if updated is None:
            return JSONResponse(status_code=404, content={
                "type": "https://api.example.com/errors/not-found",
                "title": "Order Not Found",
                "status": 404,
                "detail": f"Order {order_id} not found",
            })

        return JSONResponse(status_code=200, content=updated.dict())
    except Exception as e:
        return JSONResponse(status_code=500, content=create_error_response(e))

[HttpPut("api/v1/orders/{orderId}")]
public async Task<IActionResult> ReplaceOrder(
    string orderId, [FromBody] ReplaceOrderRequest body)
{
    try
    {
        var validation = ValidateCompleteOrder(body);
        if (!validation.Valid)
        {
            return BadRequest(new
            {
                type = "https://api.example.com/errors/validation-error",
                title = "Invalid Order",
                status = 400,
                detail = string.Join("; ", validation.Errors)
            });
        }

        var updated = await _orderService.ReplaceOrderAsync(orderId, body);
        if (updated == null)
        {
            return NotFound(new
            {
                type = "https://api.example.com/errors/not-found",
                title = "Order Not Found",
                status = 404,
                detail = $"Order {orderId} not found"
            });
        }

        return Ok(updated);
    }
    catch (Exception e)
    {
        return StatusCode(500, CreateErrorResponse(e));
    }
}

app.patch('/api/v1/orders/:orderId', (req, res) => {
  try {
    const updates = req.body; // Only provided fields
    
    // Validate only the fields being updated
    const validation = validateOrderUpdates(updates);
    if (!validation.valid) {
      return res.status(400).json({
        type: 'https://api.example.com/errors/validation-error',
        title: 'Invalid Update',
        status: 400,
        detail: validation.errors.join('; '),
      });
    }
    
    // Apply partial updates
    const updated = await orderService.patchOrder(req.params.orderId, updates);
    
    if (!updated) {
      return res.status(404).json({
        type: 'https://api.example.com/errors/not-found',
        title: 'Order Not Found',
        status: 404,
        detail: `Order ${req.params.orderId} not found`,
      });
    }
    
    res.status(200).json(updated);
  } catch (error) {
    res.status(500).json(createErrorResponse(error));
  }
});

@PatchMapping("/api/v1/orders/{orderId}")
public ResponseEntity<?> patchOrder(
        @PathVariable String orderId,
        @RequestBody Map<String, Object> updates) {
    try {
        ValidationResult validation = validateOrderUpdates(updates);
        if (!validation.isValid()) {
            return ResponseEntity.status(400).body(Map.of(
                "type", "https://api.example.com/errors/validation-error",
                "title", "Invalid Update",
                "status", 400,
                "detail", String.join("; ", validation.getErrors())
            ));
        }

        Order updated = orderService.patchOrder(orderId, updates);
        if (updated == null) {
            return ResponseEntity.status(404).body(Map.of(
                "type", "https://api.example.com/errors/not-found",
                "title", "Order Not Found",
                "status", 404,
                "detail", "Order " + orderId + " not found"
            ));
        }

        return ResponseEntity.ok(updated);
    } catch (Exception e) {
        return ResponseEntity.status(500).body(createErrorResponse(e));
    }
}

from fastapi import APIRouter
from fastapi.responses import JSONResponse

router = APIRouter()

@router.patch("/api/v1/orders/{order_id}")
async def patch_order(order_id: str, updates: dict):
    try:
        validation = validate_order_updates(updates)
        if not validation.valid:
            return JSONResponse(status_code=400, content={
                "type": "https://api.example.com/errors/validation-error",
                "title": "Invalid Update",
                "status": 400,
                "detail": "; ".join(validation.errors),
            })

        updated = await order_service.patch_order(order_id, updates)
        if updated is None:
            return JSONResponse(status_code=404, content={
                "type": "https://api.example.com/errors/not-found",
                "title": "Order Not Found",
                "status": 404,
                "detail": f"Order {order_id} not found",
            })

        return JSONResponse(status_code=200, content=updated.dict())
    except Exception as e:
        return JSONResponse(status_code=500, content=create_error_response(e))

[HttpPatch("api/v1/orders/{orderId}")]
public async Task<IActionResult> PatchOrder(
    string orderId, [FromBody] JsonElement updates)
{
    try
    {
        var updateDict = System.Text.Json.JsonSerializer
            .Deserialize<Dictionary<string, object>>(updates.GetRawText())!;

        var validation = ValidateOrderUpdates(updateDict);
        if (!validation.Valid)
        {
            return BadRequest(new
            {
                type = "https://api.example.com/errors/validation-error",
                title = "Invalid Update",
                status = 400,
                detail = string.Join("; ", validation.Errors)
            });
        }

        var updated = await _orderService.PatchOrderAsync(orderId, updateDict);
        if (updated == null)
        {
            return NotFound(new
            {
                type = "https://api.example.com/errors/not-found",
                title = "Order Not Found",
                status = 404,
                detail = $"Order {orderId} not found"
            });
        }

        return Ok(updated);
    }
    catch (Exception e)
    {
        return StatusCode(500, CreateErrorResponse(e));
    }
}

app.delete('/api/v1/orders/:orderId', (req, res) => {
  try {
    const deleted = await orderService.deleteOrder(req.params.orderId);
    
    if (!deleted) {
      return res.status(404).json({
        type: 'https://api.example.com/errors/not-found',
        title: 'Order Not Found',
        status: 404,
        detail: `Order ${req.params.orderId} not found`,
      });
    }
    
    // Common pattern: return 204 No Content or 200 with deleted resource
    res.status(204).send();
  } catch (error) {
    res.status(500).json(createErrorResponse(error));
  }
});

@DeleteMapping("/api/v1/orders/{orderId}")
public ResponseEntity<?> deleteOrder(@PathVariable String orderId) {
    try {
        boolean deleted = orderService.deleteOrder(orderId);
        if (!deleted) {
            return ResponseEntity.status(404).body(Map.of(
                "type", "https://api.example.com/errors/not-found",
                "title", "Order Not Found",
                "status", 404,
                "detail", "Order " + orderId + " not found"
            ));
        }
        return ResponseEntity.noContent().build(); // 204
    } catch (Exception e) {
        return ResponseEntity.status(500).body(createErrorResponse(e));
    }
}

from fastapi import APIRouter
from fastapi.responses import JSONResponse, Response

router = APIRouter()

@router.delete("/api/v1/orders/{order_id}")
async def delete_order(order_id: str):
    try:
        deleted = await order_service.delete_order(order_id)
        if not deleted:
            return JSONResponse(status_code=404, content={
                "type": "https://api.example.com/errors/not-found",
                "title": "Order Not Found",
                "status": 404,
                "detail": f"Order {order_id} not found",
            })
        return Response(status_code=204)
    except Exception as e:
        return JSONResponse(status_code=500, content=create_error_response(e))

[HttpDelete("api/v1/orders/{orderId}")]
public async Task<IActionResult> DeleteOrder(string orderId)
{
    try
    {
        bool deleted = await _orderService.DeleteOrderAsync(orderId);
        if (!deleted)
        {
            return NotFound(new
            {
                type = "https://api.example.com/errors/not-found",
                title = "Order Not Found",
                status = 404,
                detail = $"Order {orderId} not found"
            });
        }
        return NoContent(); // 204
    }
    catch (Exception e)
    {
        return StatusCode(500, CreateErrorResponse(e));
    }
}

app.get('/api/v1/users/:id', v1UserHandler);
app.get('/api/v2/users/:id', v2UserHandler);

// Allows deprecating old versions gradually
app.use('/api/v1/*', (req, res, next) => {
  res.set('Sunset', new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toUTCString());
  res.set('Deprecation', 'true');
  next();
});

// Spring Boot — separate controllers per version
@RestController
@RequestMapping("/api/v1/users")
public class UserControllerV1 {
    @GetMapping("/{id}")
    public ResponseEntity<UserV1> getUser(@PathVariable String id) {
        return ResponseEntity.ok(userServiceV1.getUser(id));
    }
}

@RestController
@RequestMapping("/api/v2/users")
public class UserControllerV2 {
    @GetMapping("/{id}")
    public ResponseEntity<UserV2> getUser(@PathVariable String id) {
        return ResponseEntity.ok(userServiceV2.getUser(id));
    }
}

// Deprecation filter for v1
@Component
@Order(1)
public class DeprecationFilter implements Filter {
    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        if (request.getRequestURI().startsWith("/api/v1/")) {
            long sunsetMs = System.currentTimeMillis() + 30L * 24 * 3600 * 1000;
            response.setHeader("Sunset", new Date(sunsetMs).toInstant().toString());
            response.setHeader("Deprecation", "true");
        }
        chain.doFilter(req, res);
    }
}

from fastapi import APIRouter, Response
from datetime import datetime, timedelta, timezone

router_v1 = APIRouter(prefix="/api/v1")
router_v2 = APIRouter(prefix="/api/v2")

@router_v1.get("/users/{user_id}")
async def get_user_v1(user_id: str, response: Response):
    # Mark v1 as deprecated
    sunset = datetime.now(timezone.utc) + timedelta(days=30)
    response.headers["Sunset"] = sunset.strftime("%a, %d %b %Y %H:%M:%S GMT")
    response.headers["Deprecation"] = "true"
    return user_service_v1.get_user(user_id)

@router_v2.get("/users/{user_id}")
async def get_user_v2(user_id: str):
    return user_service_v2.get_user(user_id)

// ASP.NET Core — Asp.Versioning package
[ApiController]
[ApiVersion("1.0")]
[Route("api/v{version:apiVersion}/users")]
public class UserControllerV1 : ControllerBase
{
    [HttpGet("{id}")]
    [Obsolete]
    public IActionResult GetUser(string id)
    {
        var sunset = DateTime.UtcNow.AddDays(30).ToString("R");
        Response.Headers["Sunset"] = sunset;
        Response.Headers["Deprecation"] = "true";
        return Ok(_userServiceV1.GetUser(id));
    }
}

[ApiController]
[ApiVersion("2.0")]
[Route("api/v{version:apiVersion}/users")]
public class UserControllerV2 : ControllerBase
{
    [HttpGet("{id}")]
    public IActionResult GetUser(string id) => Ok(_userServiceV2.GetUser(id));
}

const apiVersion = (req: Request): string => {
  return req.get('API-Version') || req.get('Accept-Version') || '1.0';
};

app.get('/api/users/:id', (req, res) => {
  const version = apiVersion(req);
  
  if (version.startsWith('1')) {
    return userHandlerV1(req, res);
  } else if (version.startsWith('2')) {
    return userHandlerV2(req, res);
  }
  
  res.status(400).json({
    type: 'https://api.example.com/errors/unsupported-version',
    title: 'Unsupported API Version',
    status: 400,
    detail: `API version ${version} is not supported`,
  });
});

@RestController
@RequestMapping("/api/users")
public class UserController {

    @GetMapping("/{id}")
    public ResponseEntity<?> getUser(
            @PathVariable String id,
            @RequestHeader(value = "API-Version", defaultValue = "1.0") String apiVersion) {

        if (apiVersion.startsWith("1")) {
            return ResponseEntity.ok(userServiceV1.getUser(id));
        } else if (apiVersion.startsWith("2")) {
            return ResponseEntity.ok(userServiceV2.getUser(id));
        }

        return ResponseEntity.status(400).body(Map.of(
            "type", "https://api.example.com/errors/unsupported-version",
            "title", "Unsupported API Version",
            "status", 400,
            "detail", "API version " + apiVersion + " is not supported"
        ));
    }
}

from fastapi import APIRouter, Header
from fastapi.responses import JSONResponse

router = APIRouter()

@router.get("/api/users/{user_id}")
async def get_user(
    user_id: str,
    api_version: str = Header(default="1.0", alias="API-Version"),
):
    if api_version.startswith("1"):
        return user_service_v1.get_user(user_id)
    elif api_version.startswith("2"):
        return user_service_v2.get_user(user_id)

    return JSONResponse(status_code=400, content={
        "type": "https://api.example.com/errors/unsupported-version",
        "title": "Unsupported API Version",
        "status": 400,
        "detail": f"API version {api_version} is not supported",
    })

[ApiController]
[Route("api/users")]
public class UserController : ControllerBase
{
    [HttpGet("{id}")]
    public IActionResult GetUser(
        string id,
        [FromHeader(Name = "API-Version")] string apiVersion = "1.0")
    {
        if (apiVersion.StartsWith("1"))
            return Ok(_userServiceV1.GetUser(id));
        if (apiVersion.StartsWith("2"))
            return Ok(_userServiceV2.GetUser(id));

        return BadRequest(new
        {
            type = "https://api.example.com/errors/unsupported-version",
            title = "Unsupported API Version",
            status = 400,
            detail = $"API version {apiVersion} is not supported"
        });
    }
}

app.get('/api/users/:id', (req, res) => {
  const version = req.query.v || '1.0';
  // Version handling...
});

@GetMapping("/api/users/{id}")
public ResponseEntity<?> getUser(
        @PathVariable String id,
        @RequestParam(defaultValue = "1.0") String v) {
    // Version handling...
    return ResponseEntity.ok(userService.getUser(id, v));
}

from fastapi import APIRouter, Query

router = APIRouter()

@router.get("/api/users/{user_id}")
async def get_user(user_id: str, v: str = Query(default="1.0")):
    # Version handling...
    return user_service.get_user(user_id, v)

[HttpGet("api/users/{id}")]
public IActionResult GetUser(string id, [FromQuery] string v = "1.0")
{
    // Version handling...
    return Ok(_userService.GetUser(id, v));
}

interface ApiKeyCredential {
  keyId: string;
  secret: string;
}

async function validateApiKey(keyId: string, signature: string, body: string): Promise<boolean> {
  const credential = await credentialStore.get(keyId);
  if (!credential) return false;
  
  // Create signature: HMAC-SHA256(secret, method + path + timestamp + body)
  const expectedSignature = crypto
    .createHmac('sha256', credential.secret)
    .update(body)
    .digest('hex');
  
  // Timing-safe comparison
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

app.use('/api/v1/*', async (req, res, next) => {
  const auth = req.get('Authorization');
  if (!auth?.startsWith('ApiKey ')) {
    return res.status(401).json({
      type: 'https://api.example.com/errors/unauthorized',
      title: 'Unauthorized',
      status: 401,
      detail: 'Missing or invalid authorization',
    });
  }
  
  const [keyId, signature] = auth.slice(7).split(':');
  const body = req.body ? JSON.stringify(req.body) : '';
  
  const valid = await validateApiKey(keyId, signature, body);
  if (!valid) {
    return res.status(401).json({
      type: 'https://api.example.com/errors/unauthorized',
      title: 'Unauthorized',
      status: 401,
      detail: 'Invalid credentials',
    });
  }
  
  req.user = { keyId, authenticated: true };
  next();
});

@Component
public class ApiKeyFilter extends OncePerRequestFilter {

    private final CredentialStore credentialStore;

    public ApiKeyFilter(CredentialStore credentialStore) {
        this.credentialStore = credentialStore;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain)
            throws ServletException, IOException {

        String auth = request.getHeader("Authorization");
        if (auth == null || !auth.startsWith("ApiKey ")) {
            sendUnauthorized(response, "Missing or invalid authorization");
            return;
        }

        String[] parts = auth.substring(7).split(":", 2);
        if (parts.length != 2) { sendUnauthorized(response, "Invalid authorization format"); return; }

        String keyId = parts[0];
        String signature = parts[1];
        String body = new String(request.getInputStream().readAllBytes(), StandardCharsets.UTF_8);

        boolean valid = validateApiKey(keyId, signature, body);
        if (!valid) { sendUnauthorized(response, "Invalid credentials"); return; }

        SecurityContextHolder.getContext().setAuthentication(
            new ApiKeyAuthenticationToken(keyId));
        chain.doFilter(request, response);
    }

    private boolean validateApiKey(String keyId, String signature, String body) {
        ApiKeyCredential credential = credentialStore.get(keyId);
        if (credential == null) return false;

        try {
            Mac mac = Mac.getInstance("HmacSHA256");
            mac.init(new SecretKeySpec(credential.getSecret().getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
            String expected = HexFormat.of().formatHex(mac.doFinal(body.getBytes(StandardCharsets.UTF_8)));
            return MessageDigest.isEqual(signature.getBytes(), expected.getBytes());
        } catch (Exception e) { return false; }
    }

    private void sendUnauthorized(HttpServletResponse response, String detail) throws IOException {
        response.setStatus(401);
        response.setContentType("application/json");
        response.getWriter().write(String.format(
            "{\"type\":\"https://api.example.com/errors/unauthorized\",\"title\":\"Unauthorized\",\"status\":401,\"detail\":\"%s\"}", detail));
    }
}

import hmac, hashlib
from fastapi import Request
from fastapi.responses import JSONResponse
from starlette.middleware.base import BaseHTTPMiddleware

class ApiKeyMiddleware(BaseHTTPMiddleware):
    def __init__(self, app, credential_store):
        super().__init__(app)
        self.credential_store = credential_store

    async def dispatch(self, request: Request, call_next):
        if not request.url.path.startswith("/api/v1/"):
            return await call_next(request)

        auth = request.headers.get("Authorization", "")
        if not auth.startswith("ApiKey "):
            return JSONResponse(status_code=401, content={
                "type": "https://api.example.com/errors/unauthorized",
                "title": "Unauthorized",
                "status": 401,
                "detail": "Missing or invalid authorization",
            })

        parts = auth[7:].split(":", 1)
        if len(parts) != 2:
            return JSONResponse(status_code=401, content={"detail": "Invalid format"})

        key_id, signature = parts
        body = (await request.body()).decode()

        credential = self.credential_store.get(key_id)
        if not credential:
            return JSONResponse(status_code=401, content={"detail": "Invalid credentials"})

        expected = hmac.new(
            credential["secret"].encode(), body.encode(), hashlib.sha256
        ).hexdigest()

        if not hmac.compare_digest(signature, expected):
            return JSONResponse(status_code=401, content={
                "type": "https://api.example.com/errors/unauthorized",
                "title": "Unauthorized",
                "status": 401,
                "detail": "Invalid credentials",
            })

        request.state.key_id = key_id
        return await call_next(request)

public class ApiKeyMiddleware
{
    private readonly RequestDelegate _next;
    private readonly ICredentialStore _credentialStore;

    public ApiKeyMiddleware(RequestDelegate next, ICredentialStore credentialStore)
    {
        _next = next;
        _credentialStore = credentialStore;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        if (!context.Request.Path.StartsWithSegments("/api/v1"))
        {
            await _next(context);
            return;
        }

        var auth = context.Request.Headers.Authorization.ToString();
        if (!auth.StartsWith("ApiKey "))
        {
            await WriteUnauthorized(context, "Missing or invalid authorization");
            return;
        }

        var parts = auth[7..].Split(':', 2);
        if (parts.Length != 2) { await WriteUnauthorized(context, "Invalid format"); return; }

        var (keyId, signature) = (parts[0], parts[1]);
        context.Request.EnableBuffering();
        var body = await new StreamReader(context.Request.Body).ReadToEndAsync();
        context.Request.Body.Position = 0;

        var credential = await _credentialStore.GetAsync(keyId);
        if (credential == null) { await WriteUnauthorized(context, "Invalid credentials"); return; }

        var keyBytes = Encoding.UTF8.GetBytes(credential.Secret);
        var expected = Convert.ToHexString(
            HMACSHA256.HashData(keyBytes, Encoding.UTF8.GetBytes(body))).ToLower();

        if (!CryptographicOperations.FixedTimeEquals(
                Encoding.UTF8.GetBytes(signature), Encoding.UTF8.GetBytes(expected)))
        {
            await WriteUnauthorized(context, "Invalid credentials");
            return;
        }

        context.Items["keyId"] = keyId;
        await _next(context);
    }

    private static async Task WriteUnauthorized(HttpContext context, string detail)
    {
        context.Response.StatusCode = 401;
        context.Response.ContentType = "application/json";
        await context.Response.WriteAsJsonAsync(new
        {
            type = "https://api.example.com/errors/unauthorized",
            title = "Unauthorized",
            status = 401,
            detail
        });
    }
}

import https from 'https';
import fs from 'fs';
import { createSecureClient } from './http-client';

// Server setup
const serverOptions = {
  key: fs.readFileSync('./certs/server.key'),
  cert: fs.readFileSync('./certs/server.crt'),
  ca: fs.readFileSync('./certs/ca.crt'),
  requestCert: true,
  rejectUnauthorized: true,
};

https.createServer(serverOptions, app).listen(3000);

// Client setup for calling other services
export const createMtlsClient = () => {
  const tlsOptions = {
    key: fs.readFileSync('./certs/client.key'),
    cert: fs.readFileSync('./certs/client.crt'),
    ca: fs.readFileSync('./certs/ca.crt'),
    rejectUnauthorized: true,
  };
  
  const agent = new https.Agent(tlsOptions);
  
  return async (url: string, options: RequestInit = {}) => {
    return fetch(url, {
      ...options,
      agent,
    });
  };
};

// Spring Boot — configure via application.properties or programmatically
// application.properties:
// server.ssl.key-store=classpath:certs/server.p12
// server.ssl.key-store-password=changeit
// server.ssl.trust-store=classpath:certs/ca.p12
// server.ssl.client-auth=need

// mTLS HTTP client using Apache HttpClient 5
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClients;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
import javax.net.ssl.*;

@Bean
public CloseableHttpClient mtlsHttpClient() throws Exception {
    KeyStore keyStore = KeyStore.getInstance("PKCS12");
    try (var is = new FileInputStream("certs/client.p12")) {
        keyStore.load(is, "changeit".toCharArray());
    }

    KeyStore trustStore = KeyStore.getInstance("PKCS12");
    try (var is = new FileInputStream("certs/ca.p12")) {
        trustStore.load(is, "changeit".toCharArray());
    }

    SSLContext sslContext = SSLContextBuilder.create()
        .loadKeyMaterial(keyStore, "changeit".toCharArray())
        .loadTrustMaterial(trustStore, null)
        .build();

    return HttpClients.custom()
        .setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
            .setSSLSocketFactory(new SSLConnectionSocketFactory(sslContext))
            .build())
        .build();
}

# FastAPI server with mTLS via uvicorn SSL options
# Run: uvicorn main:app --ssl-keyfile certs/server.key --ssl-certfile certs/server.crt --ssl-ca-certs certs/ca.crt

# mTLS HTTP client using httpx
import httpx
import ssl

def create_mtls_client() -> httpx.AsyncClient:
    ssl_context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH, cafile="certs/ca.crt")
    ssl_context.load_cert_chain(certfile="certs/client.crt", keyfile="certs/client.key")
    ssl_context.verify_mode = ssl.CERT_REQUIRED
    return httpx.AsyncClient(verify=ssl_context)

# Usage
async def call_service(url: str):
    async with create_mtls_client() as client:
        response = await client.get(url)
        return response.json()

// Server: configure in Program.cs
builder.WebHost.ConfigureKestrel(options =>
{
    options.ConfigureHttpsDefaults(httpsOptions =>
    {
        httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
        httpsOptions.ServerCertificate = new X509Certificate2("certs/server.pfx", "changeit");
    });
});

// Client: HttpClient with mTLS
public static HttpClient CreateMtlsClient()
{
    var clientCert = new X509Certificate2("certs/client.pfx", "changeit");
    var handler = new HttpClientHandler();
    handler.ClientCertificates.Add(clientCert);
    handler.ServerCertificateCustomValidationCallback = (_, cert, _, _) =>
    {
        // Validate against CA
        var chain = new X509Chain();
        chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
        chain.ChainPolicy.CustomTrustStore.Add(new X509Certificate2("certs/ca.crt"));
        return chain.Build(cert!);
    };
    return new HttpClient(handler);
}

interface ServiceToken {
  iss: string; // issuer
  sub: string; // subject (requesting service)
  aud: string; // audience (target service)
  iat: number; // issued at
  exp: number; // expiration
  scope: string[]; // permissions
}

function createServiceToken(requestingService: string, targetService: string): string {
  const payload: ServiceToken = {
    iss: 'auth.internal',
    sub: requestingService,
    aud: targetService,
    iat: Math.floor(Date.now() / 1000),
    exp: Math.floor(Date.now() / 1000) + 3600, // 1 hour
    scope: ['read:users', 'write:orders'],
  };
  
  return jwt.sign(payload, process.env.SERVICE_TOKEN_SECRET, {
    algorithm: 'HS256',
  });
}

// Client side
async function callServiceWithJwt(targetService: string, path: string) {
  const token = createServiceToken('user-service', targetService);
  
  return fetch(`https://${targetService}/api/v1${path}`, {
    headers: {
      Authorization: `Bearer ${token}`,
    },
  });
}

// Server side verification
app.use('/api/v1/*', (req, res, next) => {
  const auth = req.get('Authorization');
  if (!auth?.startsWith('Bearer ')) {
    return res.status(401).json({
      type: 'https://api.example.com/errors/unauthorized',
      title: 'Unauthorized',
      status: 401,
      detail: 'Missing bearer token',
    });
  }
  
  try {
    const token = jwt.verify(auth.slice(7), process.env.SERVICE_TOKEN_SECRET, {
      algorithms: ['HS256'],
      audience: 'user-service',
    }) as ServiceToken;
    
    req.user = { serviceId: token.sub, scopes: token.scope };
    next();
  } catch (error) {
    res.status(401).json({
      type: 'https://api.example.com/errors/unauthorized',
      title: 'Unauthorized',
      status: 401,
      detail: 'Invalid or expired token',
    });
  }
});

// Spring Boot + io.jsonwebtoken (JJWT)
import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import javax.crypto.SecretKey;

@Service
public class ServiceTokenService {

    private final SecretKey key = Keys.hmacShaKeyFor(
        System.getenv("SERVICE_TOKEN_SECRET").getBytes(StandardCharsets.UTF_8));

    public String createServiceToken(String requestingService, String targetService) {
        return Jwts.builder()
            .issuer("auth.internal")
            .subject(requestingService)
            .audience().add(targetService).and()
            .issuedAt(new Date())
            .expiration(new Date(System.currentTimeMillis() + 3_600_000)) // 1 hour
            .claim("scope", List.of("read:users", "write:orders"))
            .signWith(key)
            .compact();
    }

    public Claims verifyServiceToken(String token, String expectedAudience) {
        return Jwts.parser()
            .verifyWith(key)
            .requireAudience(expectedAudience)
            .build()
            .parseSignedClaims(token)
            .getPayload();
    }
}

// Client side
public ResponseEntity<?> callServiceWithJwt(String targetService, String path) {
    String token = serviceTokenService.createServiceToken("user-service", targetService);
    return restTemplate.exchange(
        "https://" + targetService + "/api/v1" + path,
        HttpMethod.GET,
        new HttpEntity<>(new HttpHeaders() {{ setBearerAuth(token); }}),
        Object.class
    );
}

// Server-side verification filter
@Component
public class JwtAuthFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain)
            throws ServletException, IOException {
        String auth = request.getHeader("Authorization");
        if (auth == null || !auth.startsWith("Bearer ")) {
            response.sendError(401, "Missing bearer token");
            return;
        }
        try {
            Claims claims = serviceTokenService.verifyServiceToken(
                auth.substring(7), "user-service");
            SecurityContextHolder.getContext().setAuthentication(
                new JwtAuthenticationToken(claims));
            chain.doFilter(request, response);
        } catch (JwtException e) {
            response.sendError(401, "Invalid or expired token");
        }
    }
}

# FastAPI + PyJWT
import jwt as pyjwt
from datetime import datetime, timedelta, timezone
from fastapi import Request, HTTPException
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials

SECRET = os.environ["SERVICE_TOKEN_SECRET"]
security = HTTPBearer()

def create_service_token(requesting_service: str, target_service: str) -> str:
    now = datetime.now(timezone.utc)
    payload = {
        "iss": "auth.internal",
        "sub": requesting_service,
        "aud": target_service,
        "iat": now,
        "exp": now + timedelta(hours=1),
        "scope": ["read:users", "write:orders"],
    }
    return pyjwt.encode(payload, SECRET, algorithm="HS256")

async def call_service_with_jwt(target_service: str, path: str):
    import httpx
    token = create_service_token("user-service", target_service)
    async with httpx.AsyncClient() as client:
        return await client.get(
            f"https://{target_service}/api/v1{path}",
            headers={"Authorization": f"Bearer {token}"},
        )

# Server-side verification dependency
def verify_service_token(credentials: HTTPAuthorizationCredentials = Depends(security)):
    try:
        payload = pyjwt.decode(
            credentials.credentials,
            SECRET,
            algorithms=["HS256"],
            audience="user-service",
        )
        return {"service_id": payload["sub"], "scopes": payload.get("scope", [])}
    except pyjwt.PyJWTError:
        raise HTTPException(status_code=401, detail="Invalid or expired token")

// ASP.NET Core + System.IdentityModel.Tokens.Jwt
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;

public class ServiceTokenService
{
    private readonly SymmetricSecurityKey _key = new(
        Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("SERVICE_TOKEN_SECRET")!));

    public string CreateServiceToken(string requestingService, string targetService)
    {
        var now = DateTime.UtcNow;
        var claims = new[]
        {
            new Claim(JwtRegisteredClaimNames.Iss, "auth.internal"),
            new Claim(JwtRegisteredClaimNames.Sub, requestingService),
            new Claim(JwtRegisteredClaimNames.Aud, targetService),
            new Claim("scope", "read:users write:orders"),
        };

        var token = new JwtSecurityToken(
            claims: claims,
            notBefore: now,
            expires: now.AddHours(1),
            signingCredentials: new SigningCredentials(_key, SecurityAlgorithms.HmacSha256)
        );
        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

// Client side
public async Task<HttpResponseMessage> CallServiceWithJwtAsync(
    string targetService, string path)
{
    var token = _serviceTokenService.CreateServiceToken("user-service", targetService);
    _httpClient.DefaultRequestHeaders.Authorization =
        new AuthenticationHeaderValue("Bearer", token);
    return await _httpClient.GetAsync($"https://{targetService}/api/v1{path}");
}

// Server-side: configure JWT middleware in Program.cs
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("SERVICE_TOKEN_SECRET")!)),
            ValidateIssuer = true,
            ValidIssuer = "auth.internal",
            ValidateAudience = true,
            ValidAudience = "user-service",
            ValidateLifetime = true,
        };
    });