API key authentication in FastAPI - Mini Project: Build & Apply

API Key Authentication with FastAPI

📖 Scenario: You are building a simple web API that only allows access to users who provide a valid API key. This is like having a secret password that clients must send with their requests to use your service.

🎯 Goal: Create a FastAPI application that checks for a specific API key in the request headers and only allows access if the key is correct.

📋 What You'll Learn

Create a FastAPI app instance called app

Define a constant API key string called API_KEY with value "secret123"

Create a dependency function called verify_api_key that reads the X-API-Key header

Raise an HTTP 401 error if the API key is missing or incorrect

Create a GET endpoint /protected that uses the verify_api_key dependency

Return a JSON message {"message": "Access granted"} when the API key is valid

💡 Why This Matters

🌍 Real World

API key authentication is a simple way to secure APIs so only authorized users or applications can access them. Many public and private APIs use this method.

💼 Career

Understanding how to implement API key authentication is important for backend developers and API designers to protect services and control access.

1

Create FastAPI app and API key constant

Import FastAPI from fastapi. Create a FastAPI app instance called app. Define a constant string API_KEY with the value "secret123".

FastAPI

from fastapi import FastAPI

# Your code here

Hint

Remember to import FastAPI and create the app instance first. Then define the API_KEY variable exactly as shown.

2

Create API key verification dependency

Import Header and HTTPException from fastapi. Define a function called verify_api_key that takes a parameter x_api_key from the header X-API-Key using Header(). Inside the function, raise HTTPException(status_code=401, detail="Invalid or missing API Key") if x_api_key is missing or not equal to API_KEY.

FastAPI

from fastapi import FastAPI, Header, HTTPException

app = FastAPI()
API_KEY = "secret123"

# Your code here

Hint

Use Header() to read the X-API-Key header. Check if it matches API_KEY. Raise HTTPException with status 401 if not.

3

Create protected GET endpoint using dependency

Import Depends from fastapi. Create a GET endpoint /protected using @app.get("/protected"). Add a parameter api_key with type None and default value Depends(verify_api_key) to enforce the API key check. Return a dictionary {"message": "Access granted"} from the endpoint.

FastAPI

from fastapi import FastAPI, Header, HTTPException, Depends

app = FastAPI()
API_KEY = "secret123"

def verify_api_key(x_api_key: str | None = Header(default=None)):
    if x_api_key != API_KEY:
        raise HTTPException(status_code=401, detail="Invalid or missing API Key")

# Your code here

Hint

Use Depends(verify_api_key) in the endpoint parameter to require the API key check before running the endpoint code.

4

Add final app run guard for local testing

Add the standard Python check if __name__ == "__main__" at the bottom. Inside it, import uvicorn and run uvicorn.run(app, host="127.0.0.1", port=8000) to start the server locally.

FastAPI

from fastapi import FastAPI, Header, HTTPException, Depends

app = FastAPI()
API_KEY = "secret123"

def verify_api_key(x_api_key: str | None = Header(default=None)):
    if x_api_key != API_KEY:
        raise HTTPException(status_code=401, detail="Invalid or missing API Key")

@app.get("/protected")
def protected(api_key: None = Depends(verify_api_key)):
    return {"message": "Access granted"}

# Your code here

Hint

This lets you run the FastAPI app locally by running the script directly.

Practice

1. What is the main purpose of using API key authentication in a FastAPI application?

easy

A. To restrict access to the API by requiring a secret key in requests

B. To speed up the API response time

C. To automatically generate API documentation

D. To format the API response as JSON

Solution

1. Step 1: Understand API key authentication purpose

   API key authentication is used to protect APIs by requiring a secret key from clients.

2. Step 2: Identify the correct purpose in options

   Only To restrict access to the API by requiring a secret key in requests describes restricting access using a secret key, which matches the purpose.

3. Final Answer:

   To restrict access to the API by requiring a secret key in requests -> Option A

4. Quick Check:

   API key authentication = restrict access [OK]

Hint: API keys control who can use the API [OK]

Common Mistakes:

• Confusing API key with speeding up API
• Thinking API key generates docs
• Assuming API key changes response format

2. Which FastAPI import is used to extract an API key from the request header?

easy

A. from fastapi import Header

B. from fastapi.security import APIKeyHeader

C. from fastapi.security import OAuth2PasswordBearer

D. from fastapi import Depends

Solution

1. Step 1: Identify the correct security class for API key in header

   FastAPI provides APIKeyHeader to extract API keys from headers.

2. Step 2: Compare options to find the exact import

   from fastapi.security import APIKeyHeader imports APIKeyHeader from fastapi.security, which is correct.

3. Final Answer:

   from fastapi.security import APIKeyHeader -> Option B

4. Quick Check:

   API key header extractor = APIKeyHeader [OK]

Hint: API keys in headers use APIKeyHeader import [OK]

Common Mistakes:

• Using OAuth2PasswordBearer for API keys
• Confusing Header with APIKeyHeader
• Missing import from fastapi.security

3. Given this FastAPI code snippet, what will be the response if the client sends a request without the 'X-API-Key' header?

from fastapi import FastAPI, Security, HTTPException
from fastapi.security import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name='X-API-Key')

@app.get('/secure')
async def secure_endpoint(api_key: str = Security(api_key_header)):
    if api_key != 'secret123':
        raise HTTPException(status_code=403, detail='Invalid API Key')
    return {'message': 'Access granted'}

medium

A. 403 Forbidden with detail 'Invalid API Key'

B. 200 OK with message 'Access granted'

C. 500 Internal Server Error

D. 422 Unprocessable Entity error

Solution

1. Step 1: Understand Security dependency behavior

   If the required header 'X-API-Key' is missing, FastAPI returns a 422 error before entering the function.

2. Step 2: Analyze the code's error handling

   The 403 error triggers only if the key is present but incorrect. Missing header causes 422 instead.

3. Final Answer:

   422 Unprocessable Entity error -> Option D

4. Quick Check:

   Missing header = 422 error [OK]

Hint: Missing required header causes 422 error [OK]

Common Mistakes:

• Assuming missing key triggers 403 error
• Expecting 200 OK without key
• Thinking server crashes with 500 error

4. Identify the error in this FastAPI API key authentication code:

from fastapi import FastAPI, Security, HTTPException
from fastapi.security import APIKeyHeader

app = FastAPI()
api_key_header = APIKeyHeader(name='X-API-Key')

@app.get('/data')
async def get_data(api_key: str = api_key_header):
    if api_key != 'topsecret':
        raise HTTPException(status_code=401, detail='Unauthorized')
    return {'data': 'Here is your data'}

medium

A. Missing Security() wrapper around api_key_header in function parameter

B. Incorrect HTTP status code for unauthorized access

C. APIKeyHeader should be named 'Authorization' instead of 'X-API-Key'

D. Function should be synchronous, not async

Solution

1. Step 1: Check how APIKeyHeader is used in dependency

   FastAPI requires Security() to wrap APIKeyHeader for dependency injection.

2. Step 2: Identify missing Security() in parameter

   The code uses api_key: str = api_key_header instead of Security(api_key_header).

3. Final Answer:

   Missing Security() wrapper around api_key_header in function parameter -> Option A

4. Quick Check:

   APIKeyHeader needs Security() [OK]

Hint: Wrap APIKeyHeader with Security() in parameters [OK]

Common Mistakes:

• Omitting Security() causes injection failure
• Using wrong header name is not an error here
• HTTP status 401 is acceptable for unauthorized

5. You want to secure multiple endpoints in FastAPI using the same API key header. Which approach is best to avoid repeating code?

hard

A. Use a global variable to store the API key and check it manually in each endpoint

B. Copy the API key check code inside every endpoint function

C. Create a reusable dependency function that checks the API key and use Security() with it

D. Disable authentication and rely on client honesty

Solution

1. Step 1: Understand code reuse in FastAPI dependencies

   FastAPI encourages reusable dependencies to share logic like API key checks.

2. Step 2: Identify best practice for API key checks

   Creating a dependency function with Security() allows clean reuse across endpoints.

3. Final Answer:

   Create a reusable dependency function that checks the API key and use Security() with it -> Option C

4. Quick Check:

   Reusable dependency = clean, DRY code [OK]

Hint: Use reusable dependency functions for API key checks [OK]

Common Mistakes:

• Copy-pasting code leads to duplication
• Using global variables breaks encapsulation
• Disabling authentication is insecure