API key authentication in FastAPI

Introduction

API key authentication helps protect your app by checking if the user has a secret key. It stops strangers from using your app without permission.

You want to let only trusted users access your API.

You need a simple way to secure your app without complex login systems.

You want to track who is using your API by giving each user a unique key.

You want to quickly block a user by disabling their API key.

You want to protect certain routes in your FastAPI app from public access.

Syntax

FastAPI

from fastapi import FastAPI, Security, HTTPException
from fastapi.security.api_key import APIKeyHeader

api_key_header = APIKeyHeader(name="X-API-Key")

app = FastAPI()

async def get_api_key(api_key: str = Security(api_key_header)):
    if api_key != "mysecretkey":
        raise HTTPException(status_code=403, detail="Could not validate API key")
    return api_key

@app.get("/protected")
async def protected_route(api_key: str = Security(get_api_key)):
    return {"message": "You have access!"}

Use APIKeyHeader to read the API key from request headers.

The Security function helps FastAPI check the key automatically.

Examples

This sets up FastAPI to look for the API key in the header named X-API-Key.

FastAPI

api_key_header = APIKeyHeader(name="X-API-Key")

This function checks if the API key matches the secret key and blocks access if not.

FastAPI

async def get_api_key(api_key: str = Security(api_key_header)):
    if api_key != "mysecretkey":
        raise HTTPException(status_code=403, detail="Could not validate API key")
    return api_key

This route is protected and only accessible if the API key is valid.

FastAPI

@app.get("/protected")
async def protected_route(api_key: str = Security(get_api_key)):
    return {"message": "Access granted"}

Sample Program

This FastAPI app has one protected route /secure-data. It requires the header X-API-Key with the value supersecret123. If the key is missing or wrong, it returns a 403 error.

FastAPI

from fastapi import FastAPI, Security, HTTPException
from fastapi.security.api_key import APIKeyHeader

api_key_header = APIKeyHeader(name="X-API-Key")

app = FastAPI()

async def get_api_key(api_key: str = Security(api_key_header)):
    if api_key != "supersecret123":
        raise HTTPException(status_code=403, detail="Could not validate API key")
    return api_key

@app.get("/secure-data")
async def secure_data(api_key: str = Security(get_api_key)):
    return {"data": "This is protected data."}

Important Notes

Always keep your API keys secret and do not share them publicly.

Use HTTPS to keep API keys safe during transmission.

You can store multiple valid API keys and check if the provided key is in that list.

Summary

API key authentication protects your API by requiring a secret key in requests.

FastAPI makes it easy to check API keys using APIKeyHeader and Security.

Use this method to control who can access your app and keep your data safe.

Practice

1. What is the main purpose of using API key authentication in a FastAPI application?

easy

A. To restrict access to the API by requiring a secret key in requests

B. To speed up the API response time

C. To automatically generate API documentation

D. To format the API response as JSON

Solution

1. Step 1: Understand API key authentication purpose

   API key authentication is used to protect APIs by requiring a secret key from clients.

2. Step 2: Identify the correct purpose in options

   Only To restrict access to the API by requiring a secret key in requests describes restricting access using a secret key, which matches the purpose.

3. Final Answer:

   To restrict access to the API by requiring a secret key in requests -> Option A

4. Quick Check:

   API key authentication = restrict access [OK]

Hint: API keys control who can use the API [OK]

Common Mistakes:

• Confusing API key with speeding up API
• Thinking API key generates docs
• Assuming API key changes response format

2. Which FastAPI import is used to extract an API key from the request header?

easy

A. from fastapi import Header

B. from fastapi.security import APIKeyHeader

C. from fastapi.security import OAuth2PasswordBearer

D. from fastapi import Depends

Solution

1. Step 1: Identify the correct security class for API key in header

   FastAPI provides APIKeyHeader to extract API keys from headers.

2. Step 2: Compare options to find the exact import

   from fastapi.security import APIKeyHeader imports APIKeyHeader from fastapi.security, which is correct.

3. Final Answer:

   from fastapi.security import APIKeyHeader -> Option B

4. Quick Check:

   API key header extractor = APIKeyHeader [OK]

Hint: API keys in headers use APIKeyHeader import [OK]

Common Mistakes:

• Using OAuth2PasswordBearer for API keys
• Confusing Header with APIKeyHeader
• Missing import from fastapi.security

3. Given this FastAPI code snippet, what will be the response if the client sends a request without the 'X-API-Key' header?

from fastapi import FastAPI, Security, HTTPException
from fastapi.security import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name='X-API-Key')

@app.get('/secure')
async def secure_endpoint(api_key: str = Security(api_key_header)):
    if api_key != 'secret123':
        raise HTTPException(status_code=403, detail='Invalid API Key')
    return {'message': 'Access granted'}

medium

A. 403 Forbidden with detail 'Invalid API Key'

B. 200 OK with message 'Access granted'

C. 500 Internal Server Error

D. 422 Unprocessable Entity error

Solution

1. Step 1: Understand Security dependency behavior

   If the required header 'X-API-Key' is missing, FastAPI returns a 422 error before entering the function.

2. Step 2: Analyze the code's error handling

   The 403 error triggers only if the key is present but incorrect. Missing header causes 422 instead.

3. Final Answer:

   422 Unprocessable Entity error -> Option D

4. Quick Check:

   Missing header = 422 error [OK]

Hint: Missing required header causes 422 error [OK]

Common Mistakes:

• Assuming missing key triggers 403 error
• Expecting 200 OK without key
• Thinking server crashes with 500 error

4. Identify the error in this FastAPI API key authentication code:

from fastapi import FastAPI, Security, HTTPException
from fastapi.security import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name='X-API-Key')

@app.get('/data')
async def get_data(api_key: str = api_key_header):
    if api_key != 'topsecret':
        raise HTTPException(status_code=401, detail='Unauthorized')
    return {'data': 'Here is your data'}

medium

A. Missing Security() wrapper around api_key_header in function parameter

B. Incorrect HTTP status code for unauthorized access

C. APIKeyHeader should be named 'Authorization' instead of 'X-API-Key'

D. Function should be synchronous, not async

Solution

1. Step 1: Check how APIKeyHeader is used in dependency

   FastAPI requires Security() to wrap APIKeyHeader for dependency injection.

2. Step 2: Identify missing Security() in parameter

   The code uses api_key: str = api_key_header instead of Security(api_key_header).

3. Final Answer:

   Missing Security() wrapper around api_key_header in function parameter -> Option A

4. Quick Check:

   APIKeyHeader needs Security() [OK]

Hint: Wrap APIKeyHeader with Security() in parameters [OK]

Common Mistakes:

• Omitting Security() causes injection failure
• Using wrong header name is not an error here
• HTTP status 401 is acceptable for unauthorized

5. You want to secure multiple endpoints in FastAPI using the same API key header. Which approach is best to avoid repeating code?

hard

A. Use a global variable to store the API key and check it manually in each endpoint

B. Copy the API key check code inside every endpoint function

C. Create a reusable dependency function that checks the API key and use Security() with it

D. Disable authentication and rely on client honesty

Solution

1. Step 1: Understand code reuse in FastAPI dependencies

   FastAPI encourages reusable dependencies to share logic like API key checks.

2. Step 2: Identify best practice for API key checks

   Creating a dependency function with Security() allows clean reuse across endpoints.

3. Final Answer:

   Create a reusable dependency function that checks the API key and use Security() with it -> Option C

4. Quick Check:

   Reusable dependency = clean, DRY code [OK]

Hint: Use reusable dependency functions for API key checks [OK]

Common Mistakes:

• Copy-pasting code leads to duplication
• Using global variables breaks encapsulation
• Disabling authentication is insecure