API key authentication concept in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when a valid API key is provided?

Consider this Flask route that checks for an API key in the request headers. What will the response be if the correct API key is sent?

Flask

from flask import Flask, request, jsonify
app = Flask(__name__)

API_KEY = 'secret123'

@app.route('/data')
def data():
    key = request.headers.get('X-API-KEY')
    if key == API_KEY:
        return jsonify({'message': 'Access granted'})
    else:
        return jsonify({'message': 'Access denied'}), 401

A {"message": "Access granted"}

B {"message": "Access denied"}

C 500 Internal Server Error

D 404 Not Found

💡 Hint

Check what happens when the header X-API-KEY matches the API_KEY variable.

If the API key in the request header matches the expected key, the route returns a JSON message saying 'Access granted'. Otherwise, it returns 'Access denied' with a 401 status.

📝 Syntax

intermediate

Which option correctly extracts the API key from request headers?

In Flask, which code snippet correctly retrieves the API key from the request headers?

A key = request.headers.get('X-API-KEY')

B key = request.get_header('X-API-KEY')

C key = request.headers['x-api-key']

D key = request.header('X-API-KEY')

💡 Hint

Remember the correct attribute name for headers in Flask's request object.

The request.headers is a dictionary-like object. The get method safely retrieves the header value or returns None if missing. Other options are either invalid methods or case-sensitive keys that may cause errors.

🔧 Debug

advanced

Why does this API key check always deny access?

Look at this Flask route code. Why does it always return 'Access denied' even when the correct API key is sent?

Flask

from flask import Flask, request, jsonify
app = Flask(__name__)

API_KEY = 'secret123'

@app.route('/secure')
def secure():
    key = request.headers.get('X-API-KEY')
    if key is API_KEY:
        return jsonify({'message': 'Access granted'})
    else:
        return jsonify({'message': 'Access denied'}), 401

A The header name 'X-API-KEY' is incorrect and should be lowercase.

B Using 'is' compares object identity, not string equality, causing the check to fail.

C The API_KEY variable is not defined in the route function scope.

D Flask requires API keys to be passed as query parameters, not headers.

💡 Hint

Consider how Python compares strings with 'is' vs '=='.

The 'is' operator checks if two variables point to the same object in memory. For strings, this is unreliable. The correct way is to use '==' to compare string values.

❓ state_output

advanced

What is the response status code when no API key is provided?

Given this Flask route, what HTTP status code will the client receive if the request does not include the 'X-API-KEY' header?

Flask

from flask import Flask, request, jsonify
app = Flask(__name__)

API_KEY = 'secret123'

@app.route('/info')
def info():
    key = request.headers.get('X-API-KEY')
    if key == API_KEY:
        return jsonify({'data': 'Here is your info'})
    else:
        return jsonify({'error': 'API key missing or invalid'}), 401

A 200

B 403

C 401

D 400

💡 Hint

Check the status code returned when the API key check fails.

The route returns a 401 Unauthorized status code when the API key is missing or incorrect, signaling the client must provide valid credentials.

🧠 Conceptual

expert

Why is API key authentication considered less secure than OAuth?

Choose the best explanation why API key authentication is generally less secure than OAuth for protecting APIs.

A API keys encrypt the entire request, while OAuth only encrypts the headers.

B API keys require complex token exchanges which slow down the API response time.

C OAuth does not support token expiration, so API keys are preferred for security.

D API keys are static and sent with every request, making them easier to steal and reuse.

💡 Hint

Think about how API keys and OAuth tokens are handled and their security features.

API keys are usually fixed strings sent with each request, which can be intercepted and reused by attackers. OAuth uses temporary tokens with expiration and scopes, improving security.