In my current setup, I receive a HTTP request, validates it and the add new headers with api-key etc which are required to call upstream. I do not wish to hardcode them as “add headers” with request-transformers plugins. I do have a hashicorp vault which I am using for my application. Can that be used to inject api-key in transformer plugin?
Absolutely.
You could either use the serverless plugin or a custom plugin to make an API call to Vault to get that and then cache it inside Kong (so that you don’t do the API call to Vault for each request that Kong sees).