# Key-auth and session plugins used together

**URL:** <https://discuss.konghq.com/t/key-auth-and-session-plugins-used-together/7072>\
**Category:** Questions\
**Created:** [September 7, 2020, 10:31am UTC](https://discuss.konghq.com/t/key-auth-and-session-plugins-used-together/7072 "2020-09-07T10:31:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sean.1.barry](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@sean.1.barry](https://discuss.konghq.com/u/sean.1.barry)\
**Post date:** [September 7, 2020, 10:31am UTC](https://discuss.konghq.com/t/key-auth-and-session-plugins-used-together/7072/1 "2020-09-07T10:31:58Z")

</div>

I am new to Kong and have a setup with the key-auth plugin enabled. So when I go to `https://localhost:32443` I get `{"message":"No API key found in request"}` . If I specify an apikey I get the homepage of the application but it is blank. The first request succeeds with a 200 response - `https://localhost:32443/?apikey=EMCmOc4oE3KjE3CtCoqqDZ9cBM8mEJWjDcOuPJLXPZCmOJbb` - because it includes ‘apikey’. All subsequent requests that the page makes to download minified JS and CSS fail with 401 because they don’t include the ‘apikey’. I have tried to configure the application to use the’session’ plugin but not sure if this is the right thing to do or I just haven’t configured it correctly.

```auto
Request URL: https://localhost:32443/favicon.ico
Request Method: GET
Status Code: 401 
Remote Address: 127.0.0.1:32443
Referrer Policy: no-referrer-when-downgrade
content-length: 41
content-type: application/json; charset=utf-8
date: Sun, 06 Sep 2020 07:32:32 GMT
server: kong/2.0.4
status: 401
www-authenticate: Key realm="kong"
x-kong-response-latency: 1
:authority: localhost:32443
:method: GET
:path: /favicon.ico
:scheme: https
accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: session_2=dhhdjdjdjjd...
referer: https://localhost:32443/?apikey=EMCmOc4oE3KjE3CtCoqqDZ9cBM8mEJWjDcOuPJLXPZCmOJbb
sec-fetch-dest: image
sec-fetch-mode: no-cors
sec-fetch-site: same-origin
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/85.0.4183.83 Safari/537.36

```

If I manually add the ‘apikey’ to the favicon request in a new tab then it loads fine. I’m not sure if there is configuration that I am missing that will automatically do this for all requests?

Many thanks