From 9f347ef9ded6f4cbcfe73748fb1a54af12c2283b Mon Sep 17 00:00:00 2001
From: jade <jade.kimhs@gmail.com>
Date: Tue, 18 Aug 2026 14:46:39 +0900
Subject: [PATCH] fix(security): Set tool-server-api-key property and revert
 header name

---
 .../java/io/shinhanlife/dap/mcg/service/ExecuteService.java     | 2 +-
 dap-gateway/src/main/resources/application-local.yml            | 1 +
 dap-gateway/src/main/resources/application.yml                  | 1 +
 .../io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java  | 2 +-
 4 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java b/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java
index 188774e8..a27d2d64 100644
--- a/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java
+++ b/dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java
@@ -263,7 +263,7 @@ public class ExecuteService {
                     headers.put("request-id", java.util.UUID.randomUUID().toString());
                     String apiKey = properties.toolServerApiKey();
                     if (apiKey != null && !apiKey.isEmpty()) {
-                        headers.put("apiKey", apiKey);
+                        headers.put("X-Tool-Server-API-Key", apiKey);
                     }
                     
                     ObjectNode pageArguments = paginationValidator.normalize(metadata, arguments);
diff --git a/dap-gateway/src/main/resources/application-local.yml b/dap-gateway/src/main/resources/application-local.yml
index 6b4522a3..27086b5d 100644
--- a/dap-gateway/src/main/resources/application-local.yml
+++ b/dap-gateway/src/main/resources/application-local.yml
@@ -29,6 +29,7 @@ eims:
     url: http://localhost:${server.port}/api/mock/esb/string
 
 mcp:
+  tool-server-api-key: tool-server-key
   adapter:
     url: http://localhost:${server.port}/rpc/v1/execute
   gateway:
diff --git a/dap-gateway/src/main/resources/application.yml b/dap-gateway/src/main/resources/application.yml
index a578d681..53501aa1 100644
--- a/dap-gateway/src/main/resources/application.yml
+++ b/dap-gateway/src/main/resources/application.yml
@@ -28,6 +28,7 @@ report:
   service-url: ${REPORT_SERVICE_URL:http://tool-report:8092}
 
 mcp:
+  tool-server-api-key: tool-server-key
   gateway:
     fallback:
       default-url: http://was-cus:8084
diff --git a/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java b/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java
index e0ba1f99..a4c0295b 100644
--- a/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java
+++ b/dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java
@@ -39,7 +39,7 @@ public class ApiKeyInterceptor implements HandlerInterceptor {
             return true;
         }
 
-        String apiKey = request.getHeader("apiKey");
+        String apiKey = request.getHeader("X-Tool-Server-API-Key");
         Map<String, String> validApiKeys = securityProperties.getApiKeys();
 
         // 2. 만약 프로퍼티에 API Key가 하나도 설정되어 있지 않다면 (개발/로컬 환경 등) 인증 없이 통과시킵니다.