API key authentication in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when a valid API key is provided?

Consider this FastAPI endpoint that requires an API key for access. What will the endpoint return if the correct API key is sent in the header?

FastAPI

from fastapi import FastAPI, Security, HTTPException
from fastapi.security.api_key import APIKeyHeader

app = FastAPI()
API_KEY = "secret123"
api_key_header = APIKeyHeader(name="X-API-Key")

@app.get("/secure-data")
async def secure_data(api_key: str = Security(api_key_header)):
    if api_key == API_KEY:
        return {"message": "Access granted"}
    else:
        raise HTTPException(status_code=403, detail="Invalid API Key")

A HTTP 401 Unauthorized error

B {"detail": "Invalid API Key"}

C {"message": "Access granted"}

D HTTP 404 Not Found error

💡 Hint

Think about what the function returns when the API key matches the expected value.

If the API key sent in the header matches the expected key, the endpoint returns a JSON message confirming access. Otherwise, it raises a 403 error.

📝 Syntax

intermediate

Which option causes a syntax error in API key dependency declaration?

Which of the following API key dependency declarations in FastAPI will cause a syntax error?

FastAPI

from fastapi.security.api_key import APIKeyHeader

# Assume API_KEY_HEADER_NAME = "X-API-Key"

A api_key_header = APIKeyHeader(name='X-API-Key')

B api_key_header = APIKeyHeader(name=API_KEY_HEADER_NAME)

C api_key_header = APIKeyHeader(name="X-API-Key")

D api_key_header = APIKeyHeader(name=)

💡 Hint

Look for incomplete or missing arguments in function calls.

Option D is missing a value for the 'name' parameter, causing a syntax error.

❓ state_output

advanced

What is the response status code when no API key is sent?

Given this FastAPI endpoint using APIKeyHeader, what HTTP status code will the client receive if the request omits the API key header?

FastAPI

from fastapi import FastAPI, Security
from fastapi.security.api_key import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name="X-API-Key")

@app.get("/data")
async def get_data(api_key: str = Security(api_key_header)):
    return {"data": "secret info"}

A 403 Forbidden

B 401 Unauthorized

C 422 Unprocessable Entity

D 200 OK

💡 Hint

Think about how FastAPI's Security dependencies behave when required headers are missing.

When the API key header is missing, FastAPI returns a 401 Unauthorized error by default.

🔧 Debug

advanced

Why does this FastAPI API key check always raise 403 even with correct key?

Examine the code below. Even when the correct API key is sent, the endpoint always raises a 403 error. What is the cause?

FastAPI

from fastapi import FastAPI, Security, HTTPException
from fastapi.security.api_key import APIKeyHeader

app = FastAPI()
API_KEY = "secret123"
api_key_header = APIKeyHeader(name="X-API-Key")

@app.get("/check")
async def check_key(api_key: str = Security(api_key_header)):
    if api_key is API_KEY:
        return {"status": "valid"}
    else:
        raise HTTPException(status_code=403, detail="Invalid API Key")

A Using 'is' instead of '==' for string comparison causes the logic to fail.

B APIKeyHeader does not extract the header correctly without alias.

C The API_KEY variable is not defined properly.

D The endpoint path is missing a leading slash.

💡 Hint

Check how string comparison works in Python.

Using 'is' compares object identity, not string content. This causes the condition to fail even if strings have the same content.

🧠 Conceptual

expert

Which option best describes the security risk of exposing API keys in client-side code?

Why is it a bad idea to include API keys directly in frontend JavaScript code that runs in browsers?

A API keys in client code can be easily seen and stolen by anyone using browser developer tools.

B API keys in client code improve security by making them harder to guess.

C API keys in client code are encrypted by browsers, so they are safe.

D API keys in client code automatically expire after one use, so no risk exists.

💡 Hint

Think about what users can do with browser developer tools.

Any code running in the browser is visible to users, so API keys included there can be copied and misused.

Practice

1. What is the main purpose of using API key authentication in a FastAPI application?

easy

A. To restrict access to the API by requiring a secret key in requests

B. To speed up the API response time

C. To automatically generate API documentation

D. To format the API response as JSON

Solution

1. Step 1: Understand API key authentication purpose

   API key authentication is used to protect APIs by requiring a secret key from clients.

2. Step 2: Identify the correct purpose in options

   Only To restrict access to the API by requiring a secret key in requests describes restricting access using a secret key, which matches the purpose.

3. Final Answer:

   To restrict access to the API by requiring a secret key in requests -> Option A

4. Quick Check:

   API key authentication = restrict access [OK]

Hint: API keys control who can use the API [OK]

Common Mistakes:

• Confusing API key with speeding up API
• Thinking API key generates docs
• Assuming API key changes response format

2. Which FastAPI import is used to extract an API key from the request header?

easy

A. from fastapi import Header

B. from fastapi.security import APIKeyHeader

C. from fastapi.security import OAuth2PasswordBearer

D. from fastapi import Depends

Solution

1. Step 1: Identify the correct security class for API key in header

   FastAPI provides APIKeyHeader to extract API keys from headers.

2. Step 2: Compare options to find the exact import

   from fastapi.security import APIKeyHeader imports APIKeyHeader from fastapi.security, which is correct.

3. Final Answer:

   from fastapi.security import APIKeyHeader -> Option B

4. Quick Check:

   API key header extractor = APIKeyHeader [OK]

Hint: API keys in headers use APIKeyHeader import [OK]

Common Mistakes:

• Using OAuth2PasswordBearer for API keys
• Confusing Header with APIKeyHeader
• Missing import from fastapi.security

3. Given this FastAPI code snippet, what will be the response if the client sends a request without the 'X-API-Key' header?

from fastapi import FastAPI, Security, HTTPException
from fastapi.security import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name='X-API-Key')

@app.get('/secure')
async def secure_endpoint(api_key: str = Security(api_key_header)):
    if api_key != 'secret123':
        raise HTTPException(status_code=403, detail='Invalid API Key')
    return {'message': 'Access granted'}

medium

A. 403 Forbidden with detail 'Invalid API Key'

B. 200 OK with message 'Access granted'

C. 500 Internal Server Error

D. 422 Unprocessable Entity error

Solution

1. Step 1: Understand Security dependency behavior

   If the required header 'X-API-Key' is missing, FastAPI returns a 422 error before entering the function.

2. Step 2: Analyze the code's error handling

   The 403 error triggers only if the key is present but incorrect. Missing header causes 422 instead.

3. Final Answer:

   422 Unprocessable Entity error -> Option D

4. Quick Check:

   Missing header = 422 error [OK]

Hint: Missing required header causes 422 error [OK]

Common Mistakes:

• Assuming missing key triggers 403 error
• Expecting 200 OK without key
• Thinking server crashes with 500 error

4. Identify the error in this FastAPI API key authentication code:

from fastapi import FastAPI, Security, HTTPException
from fastapi.security import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name='X-API-Key')

@app.get('/data')
async def get_data(api_key: str = api_key_header):
    if api_key != 'topsecret':
        raise HTTPException(status_code=401, detail='Unauthorized')
    return {'data': 'Here is your data'}

medium

A. Missing Security() wrapper around api_key_header in function parameter

B. Incorrect HTTP status code for unauthorized access

C. APIKeyHeader should be named 'Authorization' instead of 'X-API-Key'

D. Function should be synchronous, not async

Solution

1. Step 1: Check how APIKeyHeader is used in dependency

   FastAPI requires Security() to wrap APIKeyHeader for dependency injection.

2. Step 2: Identify missing Security() in parameter

   The code uses api_key: str = api_key_header instead of Security(api_key_header).

3. Final Answer:

   Missing Security() wrapper around api_key_header in function parameter -> Option A

4. Quick Check:

   APIKeyHeader needs Security() [OK]

Hint: Wrap APIKeyHeader with Security() in parameters [OK]

Common Mistakes:

• Omitting Security() causes injection failure
• Using wrong header name is not an error here
• HTTP status 401 is acceptable for unauthorized

5. You want to secure multiple endpoints in FastAPI using the same API key header. Which approach is best to avoid repeating code?

hard

A. Use a global variable to store the API key and check it manually in each endpoint

B. Copy the API key check code inside every endpoint function

C. Create a reusable dependency function that checks the API key and use Security() with it

D. Disable authentication and rely on client honesty

Solution

1. Step 1: Understand code reuse in FastAPI dependencies

   FastAPI encourages reusable dependencies to share logic like API key checks.

2. Step 2: Identify best practice for API key checks

   Creating a dependency function with Security() allows clean reuse across endpoints.

3. Final Answer:

   Create a reusable dependency function that checks the API key and use Security() with it -> Option C

4. Quick Check:

   Reusable dependency = clean, DRY code [OK]

Hint: Use reusable dependency functions for API key checks [OK]

Common Mistakes:

• Copy-pasting code leads to duplication
• Using global variables breaks encapsulation
• Disabling authentication is insecure