title: Header-based authentication for REST API in Phoenix
body: <p>I'm implementing a rest api in Elixir. An api-key is passed to each request to authenticate a user. In a plug I have this:</p>
  
  <pre><code>defmodule MyApp.ApiSecurity do
    def init(options) do
      options
    end
  
   def call(conn, _opts) do
      # checking if "api-key" headers exists
      # and key is valid
  
      # .... what's next?
      # if it's a) valid
      # b) invalid or there's no "api-key" header
      # ???
   end
  end
  </code></pre>
  
  <p>I know how to implement it for a normal, form-based authentication with a state and session. But in rest api there's no session. Then, what should I do? In other words, What should be in the rest of the function "call" when a) an api-key is valid b) invalid? </p>