API key authentication in FastAPI - Step-by-Step Execution

Concept Flow - API key authentication

Client sends request with API key

↓

Server receives request

↓

Extract API key from headers

↓

Check if API key is valid?

No→Reject request with 401

Yes↓

Allow access to protected resource

↓

Send response back to client

The server checks the API key sent by the client in the request headers. If valid, it allows access; otherwise, it rejects the request.

Execution Sample

FastAPI

from fastapi import FastAPI, Header, HTTPException
app = FastAPI()

@app.get("/items/")
async def read_items(x_api_key: str = Header(...)):
    if x_api_key != "secret123":
        raise HTTPException(status_code=401, detail="Invalid API Key")
    return {"message": "Access granted"}

This FastAPI code checks the API key from the request header and returns access granted if the key matches.

Execution Table

Step	Action	API Key Received	Check Result	Response
1	Client sends request with header x-api-key: 'secret123'	secret123	Matches expected key	Returns {"message": "Access granted"}
2	Client sends request with header x-api-key: 'wrongkey'	wrongkey	Does not match	Raises HTTP 401 Unauthorized error
3	Client sends request without x-api-key header	None	Missing key	Raises HTTP 422 Unprocessable Entity error

💡 Execution stops after sending response or raising error based on API key validation.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3
x_api_key	N/A	secret123	wrongkey	None
Check Result	N/A	True	False	False

Key Moments - 2 Insights

Why does the request without the API key header cause an error?

Because the API key is required as a header parameter (Header(...)) and FastAPI automatically returns a 422 error if it is missing, as shown in execution_table step 3.

What happens if the API key does not match the expected value?

The code raises an HTTPException with status 401 Unauthorized, rejecting the request as shown in execution_table step 2.

Visual Quiz - 3 Questions

Look at the execution table, what response is returned when the API key is 'secret123'?

A Raises HTTP 401 Unauthorized error

B Returns {"message": "Access granted"}

C Raises HTTP 422 Unprocessable Entity error

D Returns an empty response

💡 Hint

Check execution_table row 1 under Response column.

At which step does the API key check fail due to a missing header?

A Step 1

B Step 2

C Step 3

D None of the above

💡 Hint

Look at execution_table row 3 where API Key Received is None.

If the expected API key changes to 'newkey', how would the check result change for step 1?

A Check Result becomes False

B Check Result remains True

C API key becomes None

D Response becomes HTTP 422 error

💡 Hint

Refer to variable_tracker for Check Result values and compare with new expected key.

Concept Snapshot

API key authentication in FastAPI:
- Client sends API key in request header (e.g., x-api-key)
- Server extracts key using Header dependency
- Server compares key to expected value
- If match, access granted; else HTTP 401 error
- Missing key causes HTTP 422 error automatically

Full Transcript

API key authentication in FastAPI works by requiring the client to send a secret key in the request header. The server uses FastAPI's Header dependency to extract this key. If the key matches the expected secret, the server allows access and returns a success message. If the key is wrong, the server raises a 401 Unauthorized error. If the key is missing, FastAPI automatically returns a 422 error because the header is required. This process ensures only clients with the correct API key can access protected resources.