swagger - how to set security properly
<p>Two questions:</p>

<ol>
<li><p>When you define a new route and you want to protect it by requiring an api_key to be set in the header, do you do it by specifying a <code>security</code> section under that route in the yaml file, or do you put it under <code>parameters</code> (or in both)? If it works by putting it under <code>parameters</code>, what's the point of putting it under <code>security</code>?</p></li>
<li><p>The yaml file can tell you that certain routes are protected by an api_key, but it doesn't specify the value of that key (as far as I know). Does it mean I need the write some custom middleware that intercepts my routes and checks the validity of the key, or it can be auto-generated by one of the swagger tools?</p></li>
</ol>

<p>Thanks. </p>