API key authentication in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when a valid API key is provided?

Consider this FastAPI endpoint that requires an API key for access. What will the endpoint return if the correct API key is sent in the header?

FastAPI

from fastapi import FastAPI, Security, HTTPException
from fastapi.security.api_key import APIKeyHeader

app = FastAPI()
API_KEY = "secret123"
api_key_header = APIKeyHeader(name="X-API-Key")

@app.get("/secure-data")
async def secure_data(api_key: str = Security(api_key_header)):
    if api_key == API_KEY:
        return {"message": "Access granted"}
    else:
        raise HTTPException(status_code=403, detail="Invalid API Key")

A HTTP 401 Unauthorized error

B {"detail": "Invalid API Key"}

C {"message": "Access granted"}

D HTTP 404 Not Found error

💡 Hint

Think about what the function returns when the API key matches the expected value.

If the API key sent in the header matches the expected key, the endpoint returns a JSON message confirming access. Otherwise, it raises a 403 error.

📝 Syntax

intermediate

Which option causes a syntax error in API key dependency declaration?

Which of the following API key dependency declarations in FastAPI will cause a syntax error?

FastAPI

from fastapi.security.api_key import APIKeyHeader

# Assume API_KEY_HEADER_NAME = "X-API-Key"

A api_key_header = APIKeyHeader(name='X-API-Key')

B api_key_header = APIKeyHeader(name=API_KEY_HEADER_NAME)

C api_key_header = APIKeyHeader(name="X-API-Key")

D api_key_header = APIKeyHeader(name=)

💡 Hint

Look for incomplete or missing arguments in function calls.

Option D is missing a value for the 'name' parameter, causing a syntax error.

❓ state_output

advanced

What is the response status code when no API key is sent?

Given this FastAPI endpoint using APIKeyHeader, what HTTP status code will the client receive if the request omits the API key header?

FastAPI

from fastapi import FastAPI, Security
from fastapi.security.api_key import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name="X-API-Key")

@app.get("/data")
async def get_data(api_key: str = Security(api_key_header)):
    return {"data": "secret info"}

A 403 Forbidden

B 401 Unauthorized

C 422 Unprocessable Entity

D 200 OK

💡 Hint

Think about how FastAPI's Security dependencies behave when required headers are missing.

When the API key header is missing, FastAPI returns a 401 Unauthorized error by default.

🔧 Debug

advanced

Why does this FastAPI API key check always raise 403 even with correct key?

Examine the code below. Even when the correct API key is sent, the endpoint always raises a 403 error. What is the cause?

FastAPI

from fastapi import FastAPI, Security, HTTPException
from fastapi.security.api_key import APIKeyHeader

app = FastAPI()
API_KEY = "secret123"
api_key_header = APIKeyHeader(name="X-API-Key")

@app.get("/check")
async def check_key(api_key: str = Security(api_key_header)):
    if api_key is API_KEY:
        return {"status": "valid"}
    else:
        raise HTTPException(status_code=403, detail="Invalid API Key")

A Using 'is' instead of '==' for string comparison causes the logic to fail.

B APIKeyHeader does not extract the header correctly without alias.

C The API_KEY variable is not defined properly.

D The endpoint path is missing a leading slash.

💡 Hint

Check how string comparison works in Python.

Using 'is' compares object identity, not string content. This causes the condition to fail even if strings have the same content.

🧠 Conceptual

expert

Which option best describes the security risk of exposing API keys in client-side code?

Why is it a bad idea to include API keys directly in frontend JavaScript code that runs in browsers?

A API keys in client code can be easily seen and stolen by anyone using browser developer tools.

B API keys in client code improve security by making them harder to guess.

C API keys in client code are encrypted by browsers, so they are safe.

D API keys in client code automatically expire after one use, so no risk exists.

💡 Hint

Think about what users can do with browser developer tools.

Any code running in the browser is visible to users, so API keys included there can be copied and misused.