apikey.conf

# Error page is actually an image
error_page 403 /static/img/noaccess.png;

# define boolean
set $valid 0;

# Whitelist JOSM and Vespucci
if ($http_user_agent ~ "^(JOSM|Vespucci)") {
   set $valid 1;
}

valid_referers server_names *.openstreetmap.org openstreetmap.org *.openstreetmap.fr openstreetmap.fr

if ($invalid_referer = false)") {
   set $valid 1;
}

# api key editor-layer-index
if ($arg_apikey = '8IAiVDb0ExRfmCYo8852EghkqVnY9Bds') {
    set $valid 1;
}

# api key another example
if ($arg_apikey = 'kr0Yy3JhBIn45J5DRjTWV16Xnb11Ydpz') {
    set $valid 1;
}

# return error image if invalid
if ($valid = 0) {
    return 403;
}