//[Authorize]
    public class ValuesController : ApiController
    {
        // GET /values
        public IEnumerable<string> Get()
        {
            return new string[] { "value1", "value2" };
        }

    }

using System.Linq;
using System.Net;
using System.Security.Claims;
using System.Web.Http.Filters;
using System.Web.Http.Results;
using WebApi.AuthenticationFilter;

namespace apikey.App_Start
{
    public class ApiKeyAuthenticationFilter : AuthenticationFilterAttribute
    {
        public override void OnAuthentication(HttpAuthenticationContext context)
        {
            if (!Authenticate(context))
            {
                context.ErrorResult = new StatusCodeResult(HttpStatusCode.Unauthorized,
                    context.Request);
            }
        }

        private bool Authenticate(HttpAuthenticationContext context)
        {
            // Get the value for the "api-key" header key
            // TODO: replace hard coded literal with AppSetting
            var apikey = context.Request?
                .Headers?
                .SingleOrDefault(x => x.Key == "api-key")
                .Value?
                .FirstOrDefault();

            // TODO: replace hard coded literal with AppSetting or Database check
            if (string.IsNullOrWhiteSpace(apikey) || apikey != "password") return false;

            // Authentication logic here (ideally, assign apikeys in a database somewhere)
            var username = "someauthuser";

            // Create the claim for the username
            var usernameClaim = new Claim(ClaimTypes.Name, username);

            // Create the claim for the user role
            var roleClaim = new Claim(ClaimTypes.Role, "AuthorizedApiKeys");

            // TODO: add additional claims such as email / dob / etc

            // Build the identity
            var identity = new ClaimsIdentity(new[] { usernameClaim, roleClaim }, "ApiKey");

            // Assign/Build the pricipal
            context.Principal = new ClaimsPrincipal(identity);

            // User is authenticated
            return true;
        }
    }
}

public static class WebApiConfig
    {
        public static void Register(HttpConfiguration config)
        {
   
            // ApiKeyAuthenticationFilter 추가 
            config.Filters.Add(new ApiKeyAuthenticationFilter());

            // Web API routes
            config.MapHttpAttributeRoutes();

            config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{id}",
                defaults: new { id = RouteParameter.Optional }
            );
        }
}