What Is the API Keys Option for REST API Authentication?

350-401 By islever Editorial Last updated Aug 24, 2026

Short answer

A a predetermined string that is passed from client to server

Question

What is the API keys option for REST API authentication?

a predetermined string that is passed from client to server Correct Answer
a one-time encrypted token
a credential that is transmitted unencrypted
a username that is stored in the local router database

Key Takeaways

The exam tests whether candidates understand that an API key is a static, predetermined credential string — not a one-time token, plaintext password, or local username.

API key authentication uses a predetermined string passed from client to server to identify and authorize API requests. The Cisco community unanimously confirms option A as the correct answer for the 350-401 ENCOR exam.

Common mistake: Some candidates choose C, mistakenly believing API keys are transmitted unencrypted; however, the defining characteristic of an API key is that it is a predetermined string used for identification, regardless of transport encryption.

Expert Analysis

Why the Answer Is Correct

An API key is fundamentally a predetermined string of characters that a client passes to a server to authenticate and authorize an API request. Cisco's REST API documentation describes API keys as static credentials assigned to an application, which the server validates against a known list. This matches option A precisely: a predetermined string passed from client to server.

Why the Other Options Are Wrong

Option B describes a one-time encrypted token, which aligns more closely with OAuth 2.0 bearer tokens or JWTs rather than static API keys. Option C refers to a credential transmitted unencrypted, which is a transport-layer concern, not a definition of API key authentication. Option D describes a local router username database entry, which pertains to device CLI authentication (AAA), not REST API key authentication.

Community Comment Notes

All community voters selected A, and comment [1] correctly defines an API key as a string used to identify and authenticate an application. Comment [2] elaborates that the string acts as a credential the server validates for authorization. Comment [3] briefly marks C as correct, but this is likely a typo since the answer letter shown is A; no substantive support exists for option C in the discussion.

Official Reference

https://developer.cisco.com/docs/ios-xe/#!rest-api-authentication

This link opens the official vendor documentation in a new tab.

Exam Strategy

When the question asks about the definition of an API key, focus on its core trait: a static, predetermined string used for identification. Eliminate options that describe dynamic tokens, transport-layer behavior, or local AAA databases.

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

slacker_at_work 👍 6 Answered A

An API key is a string of characters used to identify and authenticate an application or user who requests the service of an API.
chiacche 👍 1 Answered A

When a client sends a request to the server, this string acts as a credential to verify the identity and authorization of the requester. The server validates the key to ensure the request is from an authorized application or user.
teems5uk 👍 3 Answered A

Correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide