diff --git a/sample-functions/ApiKeyProtected/.gitignore b/sample-functions/ApiKeyProtected/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..4e568b8f985c170219d528a06b52f749b942649a
--- /dev/null
+++ b/sample-functions/ApiKeyProtected/.gitignore
@@ -0,0 +1,2 @@
+ApiKeyProtected
+
diff --git a/sample-functions/ApiKeyProtected/Dockerfile b/sample-functions/ApiKeyProtected/Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..2dde4e451d590753fa483b4fe9de1da724fc629f
--- /dev/null
+++ b/sample-functions/ApiKeyProtected/Dockerfile
@@ -0,0 +1,16 @@
+FROM alpine:latest
+
+WORKDIR /root/
+
+EXPOSE 8080
+ENV http_proxy      ""
+ENV https_proxy     ""
+
+# ADD https://github.com/alexellis/faas/releases/download/v0.5-alpha/fwatchdog /usr/bin
+COPY fwatchdog  /usr/bin/
+RUN chmod +x /usr/bin/fwatchdog
+
+COPY app    .
+
+ENV fprocess="/root/app"
+CMD ["fwatchdog"]
diff --git a/sample-functions/ApiKeyProtected/Dockerfile.build b/sample-functions/ApiKeyProtected/Dockerfile.build
new file mode 100644
index 0000000000000000000000000000000000000000..146ef64f8044268aa72654832fab7d9677858074
--- /dev/null
+++ b/sample-functions/ApiKeyProtected/Dockerfile.build
@@ -0,0 +1,9 @@
+FROM golang:1.7.5
+RUN mkdir -p /go/src/app
+COPY handler.go /go/src/app
+WORKDIR /go/src/app
+
+RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .
+
+CMD ["echo"]
+
diff --git a/sample-functions/ApiKeyProtected/README.md b/sample-functions/ApiKeyProtected/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..a2a65bb157582f4926df423239e61e3c4e1e1a28
--- /dev/null
+++ b/sample-functions/ApiKeyProtected/README.md
@@ -0,0 +1,6 @@
+### Api-Key-Protected sample
+
+To use this sample provide an env variable for the container/service in `secret_api_key`.
+
+Then when calling via the gateway pass the additional header "X-Api-Key", if it matches the `secret_api_key` value then the function will give access, otherwise access denied.
+
diff --git a/sample-functions/ApiKeyProtected/build.sh b/sample-functions/ApiKeyProtected/build.sh
new file mode 100755
index 0000000000000000000000000000000000000000..4cc047ef81e68f18b3a34ce9190a71b6cedc60f6
--- /dev/null
+++ b/sample-functions/ApiKeyProtected/build.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+echo Building functions/api-key-protected:build
+
+docker build --build-arg https_proxy=$https_proxy --build-arg http_proxy=$http_proxy \
+    -t functions/api-key-protected . -f Dockerfile.build
+
+docker create --name render_extract functions/api-key-protected
+docker cp render_extract:/go/src/app/app ./app
+docker rm -f render_extract
+
+echo Building functions/api-key-protected:latest
+docker build --no-cache -t functions/api-key-protected:latest .
diff --git a/sample-functions/ApiKeyProtected/handler.go b/sample-functions/ApiKeyProtected/handler.go
new file mode 100644
index 0000000000000000000000000000000000000000..0432040632ada32286540edf97a9b4971b37a03d
--- /dev/null
+++ b/sample-functions/ApiKeyProtected/handler.go
@@ -0,0 +1,29 @@
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/alexellis/faas/watchdog/types"
+)
+
+func handle(header http.Header, body []byte) {
+	key := header.Get("X-Api-Key")
+	if key == os.Getenv("secret_api_key") {
+		fmt.Println("Unlocked the function!")
+	} else {
+		fmt.Println("Access denied!")
+	}
+}
+
+func main() {
+	bytes, _ := ioutil.ReadAll(os.Stdin)
+	req, err := types.UnmarshalRequest(bytes)
+	if err != nil {
+		log.Fatal(err)
+	}
+	handle(req.Header, req.Body.Raw)
+}