How to validate an API key in Google cloud endpoints v2

Question

I am new to Google cloud endpoints especially V2, I see it as an important layer for making service based applications . From the documentations I observed they provided options for using endpoints framework and then open api .Now when I use the frameworks with api key required and then generate the openapi.json .i can't seem to get any error when I make a request without the API key .I wonder why it is so when I have marked my class as API key required .Am I to provide the validation logic myself ?. This is the configuration for validating all methods withing the api.

@Api(name = "testapi",
    version = "v1",
    apiKeyRequired = AnnotationBoolean.TRUE,
    scopes = {Constants.EMAIL_SCOPE},
    clientIds = {Constants.WEB_CLIENT_ID, Constants.ANDROID_CLIENT_ID},
    audiences = {Constants.ANDROID_AUDIENCE}

)

And then to generate the openapi.json file this is the pom config , Although i'm still trying to grasp how to configure it in such a way i wont need to enter my service classes

 <profiles>
    <profile>
        <id>GetSwaggerDoc</id>
        <activation>
            <property>
                <name>GetSwaggerDoc</name>
            </property>
        </activation>
        <build>
            <plugins>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>exec-maven-plugin</artifactId>
                    <version>1.4.0</version>
                    <configuration>
                        <includePluginDependencies>true</includePluginDependencies>
                        <mainClass>com.google.api.server.spi.tools.EndpointsTool</mainClass>
                        <arguments>
                            <argument>get-swagger-doc</argument>
                            <argument>--hostname=test-api.endpoints.${endpoints.project.id}.cloud.goog</argument>
                            <argument>--war=target/test-1.0-SNAPSHOT</argument>
                            <argument>com.rareatom.test.services.TestApi</argument>
                        </arguments>
                    </configuration>
                    <dependencies>
                        <dependency>
                            <groupId>com.google.endpoints</groupId>
                            <artifactId>endpoints-framework-tools</artifactId>
                            <version>${endpoints.framework.version}</version>
                        </dependency>
                        <dependency>
                            <groupId>com.google.appengine</groupId>
                            <artifactId>appengine-api-1.0-sdk</artifactId>
                            <version>1.9.30</version>
                        </dependency>
                    </dependencies>
                </plugin>
            </plugins>
        </build>
    </profile>
</profiles>`

when i run mvn exec:java -DGetSwaggerDoc This is generated

{
 "swagger": "2.0",
 "info": {
  "version": "1.0.0",
  "title": "test-api.endpoints.test-test-160113.cloud.goog"
 },
 "host": "test-api.endpoints.test-test-160113.cloud.goog",
 "basePath": "/_ah/api",
 "schemes": [
  "https"
 ],
 "consumes": [
  "application/json"
 ],
 "produces": [
  "application/json"
 ],
 "paths": {
  "/testapi/v1/test": {
   "post": {
    "operationId": "TestapiTest",
    "parameters": [ ],
    "responses": {
     "200": {
      "description": "A successful response",
      "schema": {
       "$ref": "#/definitions/Response"
      }
     }
    },
    "security": [
     {
      "google_id_token": [ ]
     },
     {
      "google_id_token_https": [ ]
     },
     {
      "api_key": [ ]
     }
    ],
    "x-security": [
     {
      "google_id_token": {
       "audiences": [
        "AIzaSyAsnv2yeF6003txjfBVrZrlUe8jvfUJAtE"
       ]
      }
     },
     {
      "google_id_token_https": {
       "audiences": [
        "AIzaSyAsnv2yeF6003txjfBVrZrlUe8jvfUJAtE"
       ]
      }
     }
    ]
   }
  }
 },
 "securityDefinitions": {
  "google_id_token_https": {
   "type": "oauth2",
   "authorizationUrl": "",
   "flow": "implicit",
   "x-google-issuer": "https://accounts.google.com",
   "x-google-jwks_uri": "https://www.googleapis.com/oauth2/v1/certs"
  },
  "api_key": {
   "type": "apiKey",
   "name": "key",
   "in": "query"
  },
  "google_id_token": {
   "type": "oauth2",
   "authorizationUrl": "",
   "flow": "implicit",
   "x-google-issuer": "accounts.google.com",
   "x-google-jwks_uri": "https://www.googleapis.com/oauth2/v1/certs"
  }
 },
 "definitions": {
  "Status": {
   "enum": [
    "SUCCESS",
    "FAILURE"
   ]
  },
  "Response": {
   "properties": {
    "code": {
     "type": "integer",
     "format": "int32"
    },
    "data": {
     "$ref": "#/definitions/_any"
    },
    "message": {
     "type": "string"
    },
    "status": {
     "$ref": "#/definitions/Status"
    }
   }
  },
  "_any": { }
 }
}

This configuration is then deployed using gcloud service-management deploy .

Answer 1

I noticed that the api key is validated when you have more than one arguments or more than one @Api annotated classes in your pom.xml and your web.xml

pom.xml

<arguments>
  <argument>get-swagger-doc</argument>
  <argument>--hostname=tita-api.endpoints.${endpoints.project.id}.cloud.goog</argument>
   <argument>--war=target/tita-1.0-SNAPSHOT</argument>           
   <argument>com.rareatom.tita.services.TestApi</argument>                               
   <argument>com.rareatom.tita.services.SessionServices</argument>                     
                        </arguments>

And for your web.xml

<servlet>
    <servlet-name>EndpointsServlet</servlet-name>
    <servlet-class>com.google.api.server.spi.EndpointsServlet</servlet-class>
    <init-param>
        <param-name>services</param-name>
        <param-value>com.rareatom.tita.services.TestApi,
        com.rareatom.tita.services.SessionServices</param-value>
</init-param>
</servlet>