200-901 Cisco Platforms and Development Practice Question
When making API calls to Cisco Meraki Dashboard, what header must be included for authentication?
⚠ Common exam trap
Cisco often tests the fact that Meraki uses a custom header (`X-Cisco-Meraki-API-Key`) rather than the standard `Authorization` header, leading candidates to mistakenly choose `Authorization: Bearer <token>` or `Authorization: Basic <base64>`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
X-Cisco-Meraki-API-Key: <key>
Cisco Meraki Dashboard API uses a custom header for authentication rather than standard HTTP authentication schemes. The header `X-Cisco-Meraki-API-Key` must be included with the API key as its value. This is explicitly documented in the Meraki API reference and is required for all API requests to authenticate the caller.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authorization: Basic <base64>
Why it's wrong here
Meraki Dashboard authenticates API calls with a bearer token, not HTTP Basic credentials, so a Basic header is rejected. Basic authentication is tempting because many REST APIs accept it, and it would be correct for a service exposing standard RFC 7617 username-and-password authentication.
- ✗
Authorization: Bearer <token>
Why it's wrong here
Meraki Dashboard expects the API key in the X-Cisco-Meraki-API-Key header, not a bearer token, so this header is ignored and the call returns 401. Bearer tokens are tempting because OAuth 2.0 APIs commonly use them, and would be correct against an OAuth-protected endpoint.
- ✓
X-Cisco-Meraki-API-Key: <key>
Why this is correct
Meraki Dashboard authenticates REST calls solely through the `X-Cisco-Meraki-API-Key` request header carrying the generated API key; no OAuth bearer token or session cookie is accepted. This satisfies the stem's requirement for the mandatory authentication header on every Dashboard API call.
- ✗
Api-Key: <key>
Why it's wrong here
Meraki Dashboard requires the key in the X-Cisco-Meraki-API-Key header; Api-Key is not recognised, so authentication fails. Custom API-key headers are tempting because many services define their own, and Api-Key would be correct for an API whose documentation specifies that exact header name.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.