GatewayServlet( and HttpApiFactory?) should have a configurable api key retrieval interface that retrieves apikey string from request( GatewayServlet.getApiKey).

Example usage would be - in two way ssl mode api key can be stored in client certificate, a custom api key retrieval interface can be configured to get api key from the certificate.