From 737188081faa4bf6bc5b29057e49f5a624ad79dd Mon Sep 17 00:00:00 2001
From: Alexander Fenster <fenster@google.com>
Date: Tue, 28 May 2019 16:10:39 -0700
Subject: [PATCH 1/2] feat: use X-Goog-Api-Key header

---
 src/auth/oauth2client.ts | 2 +-
 test/test.googleauth.ts  | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/auth/oauth2client.ts b/src/auth/oauth2client.ts
index fde2f36a..92fabf70 100644
--- a/src/auth/oauth2client.ts
+++ b/src/auth/oauth2client.ts
@@ -756,7 +756,7 @@ export class OAuth2Client extends AuthClient {
     }
 
     if (this.apiKey) {
-      return {headers: {}};
+      return {headers: {'X-Goog-Api-Key': this.apiKey}};
     }
     let r: GetTokenResponse | null = null;
     let tokens: Credentials | null = null;
diff --git a/test/test.googleauth.ts b/test/test.googleauth.ts
index 440ba7e2..8cea7161 100644
--- a/test/test.googleauth.ts
+++ b/test/test.googleauth.ts
@@ -257,6 +257,12 @@ describe('googleauth', () => {
     scope.done();
   });
 
+  it('should put the api key in the headers', async () => {
+    const client = auth.fromAPIKey(API_KEY);
+    const headers = await client.getRequestHeaders();
+    assert.strictEqual(headers['X-Goog-Api-Key'], API_KEY);
+  });
+
   it('should make a request while preserving original parameters', async () => {
     const OTHER_QS_PARAM = {test: 'abc'};
     const scope = nock(BASE_URL)

From dfaa077d5e5f35a56210674e955f49117e7888cd Mon Sep 17 00:00:00 2001
From: Alexander Fenster <fenster@google.com>
Date: Tue, 28 May 2019 21:31:20 -0700
Subject: [PATCH 2/2] do not use key= parameter

---
 package.json             |  2 +-
 src/auth/oauth2client.ts |  4 ++--
 test/test.googleauth.ts  | 11 +++++------
 3 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/package.json b/package.json
index c868d32e..5c6595a4 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "@types/mocha": "^5.2.1",
     "@types/mv": "^2.1.0",
     "@types/ncp": "^2.0.1",
-    "@types/nock": "^10.0.0",
+    "@types/nock": "^10.0.3",
     "@types/node": "^10.5.1",
     "@types/semver": "^6.0.0",
     "@types/sinon": "^7.0.0",
diff --git a/src/auth/oauth2client.ts b/src/auth/oauth2client.ts
index 92fabf70..cdc0b3a6 100644
--- a/src/auth/oauth2client.ts
+++ b/src/auth/oauth2client.ts
@@ -885,9 +885,9 @@ export class OAuth2Client extends AuthClient {
         opts.headers = opts.headers || {};
         opts.headers.Authorization = r.headers.Authorization;
       }
-
       if (this.apiKey) {
-        opts.params = Object.assign(opts.params || {}, {key: this.apiKey});
+        opts.headers = opts.headers || {};
+        opts.headers['X-Goog-Api-Key'] = this.apiKey;
       }
       r2 = await this.transporter.request<T>(opts);
     } catch (e) {
diff --git a/test/test.googleauth.ts b/test/test.googleauth.ts
index 8cea7161..2c26c451 100644
--- a/test/test.googleauth.ts
+++ b/test/test.googleauth.ts
@@ -242,9 +242,8 @@ describe('googleauth', () => {
   it('should make a request with the api key', async () => {
     const scope = nock(BASE_URL)
       .post(ENDPOINT)
-      .query({key: API_KEY})
-      .reply(uri => {
-        assert(uri.indexOf('key=' + API_KEY) > -1);
+      .reply(function(uri) {
+        assert.strictEqual(this.req.headers['x-goog-api-key'][0], API_KEY);
         return [200, RESPONSE_BODY];
       });
     const client = auth.fromAPIKey(API_KEY);
@@ -267,9 +266,9 @@ describe('googleauth', () => {
     const OTHER_QS_PARAM = {test: 'abc'};
     const scope = nock(BASE_URL)
       .post(ENDPOINT)
-      .query({test: OTHER_QS_PARAM.test, key: API_KEY})
-      .reply(uri => {
-        assert(uri.indexOf('key=' + API_KEY) > -1);
+      .query({test: OTHER_QS_PARAM.test})
+      .reply(function(uri) {
+        assert.strictEqual(this.req.headers['x-goog-api-key'][0], API_KEY);
         assert(uri.indexOf('test=' + OTHER_QS_PARAM.test) > -1);
         return [200, RESPONSE_BODY];
       });