My GitHub repo shows an example of how to use Logic Apps to regenerate the primary key in an Azure API Management instance. APIM doesn’t provide a native way to rotate keys on a regular basis. Rotating API subscription keys is a good security practice since they are just a long password and should not be considered a secure method of authorizing API calls.

This repo also has an example of how to use Logic Apps in combination with an Azure Function and an Azure Key Vault to generate custom API subscription keys, store them in Key Vault and then set the key in APIM.

This repo also shows you how to use stateful Logic Apps to notify subscription owners that their API subscription keys are about to expire and ask them to approve or deny being the owner.
Pre-requisites
- Azure subscription & resource group
- Azure CLI
- dotnet CLI
- .NET 6
- Azure Function CLI
- PowerShell
- Visual Studio Code
- Logic Apps Visual Studio Code Extension
- Event Hub Visual Studio Code Extension
How to use Logic Apps to regenerate API subscription keys using native APIM capabilities
The Logic App will go through the following steps to regenerate the API subscription primary key when it is within 30 days of expiring and then notifying the owner.
- It will first query the APIM to see what API subscriptions are expiring in the next 30 days.
- It will then loop over each one and:
- Regenerate the primary key using the native API for APIM.
- Get the subscription owner ID & product name.
- Send an email to the subscription owner notifying them of the change.
You can right-click on the logic-app/rotate-subscription-key/workflow.json
file and select Open in Designer
to see the GUI tool for building Logic Apps.
How to use Logic Apps to regenerate API subscription keys via an Azure Function, store that new key in Azure Key Vault & set the new key in APIM
The Logic App will go through the following steps to generate a new API subscription primary key when it is within 30 days of expiring, saving it to Key Vault & then setting it in APIM, and then notifying the owner.
- It will first query the APIM to see what API subscriptions are expiring in the next 30 days.
- It will then loop over each one and:
- Call the Azure Function to generate a new primary key
- Save this new key to Azure Key Vault.
- Set the the primary key using the native API for APIM.
- Get the subscription owner ID & product name.
- Send an email to the subscription owner notifying them of the change.
You can right-click on the logic-app/set-subscription-key/workflow.json
file and select Open in Designer
to see the GUI tool for building Logic Apps.
How to notify API subscription owners and get their approval or denial
The Logic App will go through the following steps to notify the API subscription owner of the API subscription key expiring and wait on their response (using stateful Logic Apps).
- It will first query the APIM to see what API subscriptions are expiring in the next 30 days.
- It will then loop over each one and:
- Get the subscription owner ID & product name.
- Send an email to the subscription owner notifying them of the expiration and asking them to
Approve
orDeny
. - The Logic App will then wait on their response.
- Based upon the response, it will send a follow-up email with an
Approval
orDenial
email.
You can right-click on the logic-app/notify-subscription-owner/workflow.json
file and select Open in Designer
to see the GUI tool for building Logic Apps.
Super insightful! Going to need to try this myself! Thanks for sharing!