API key authentication concept in Flask - Step-by-Step Execution

Concept Flow - API key authentication concept

Client sends request with API key

↓

Server receives request

↓

Extract API key from headers

↓

Check if API key is valid?

No→Reject request with 401

Yes↓

Process request and send response

The server checks the API key sent by the client in the request headers. If valid, it processes the request; otherwise, it rejects it.

Execution Sample

Flask

from flask import Flask, request, jsonify
app = Flask(__name__)
API_KEYS = {"abc123"}

@app.route('/data')
def data():
    key = request.headers.get('X-API-KEY')
    if key in API_KEYS:
        return jsonify({"message": "Access granted"})
    return jsonify({"error": "Unauthorized"}), 401

A Flask route that checks for a valid API key in the request headers and returns access or error.

Execution Table

Step	Action	API Key Extracted	API Key Valid?	Response
1	Client sends request with header X-API-KEY='abc123'	abc123	Yes	Access granted (200)
2	Client sends request with header X-API-KEY='wrongkey'	wrongkey	No	Unauthorized (401)
3	Client sends request without X-API-KEY header	None	No	Unauthorized (401)

💡 Requests without valid API key are rejected with 401 Unauthorized.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3
key	None	abc123	wrongkey	None
API_KEYS	{'abc123'}	{'abc123'}	{'abc123'}	{'abc123'}

Key Moments - 2 Insights

Why does the server reject the request if the API key is missing?

Because the extracted API key is None (see execution_table step 3), which is not in the set of valid API keys, so the server returns 401 Unauthorized.

What happens if the API key is incorrect but present?

The server checks the key against the valid keys (execution_table step 2). Since it is not found, the server rejects the request with 401 Unauthorized.

Visual Quiz - 3 Questions

Look at the execution table, what is the response when the API key is 'abc123'?

A Unauthorized (401)

B Access granted (200)

C Server error (500)

D No response

💡 Hint

Check the row where API Key Extracted is 'abc123' in the execution_table.

At which step does the API key extracted become None?

A Step 3

B Step 1

C Step 2

D Never

💡 Hint

Look at the 'API Key Extracted' column in the execution_table.

If we add another valid key 'xyz789' to API_KEYS, what would happen at step 2 if the client sends 'xyz789'?

A Response would be Unauthorized (401)

B Server would crash

C Response would be Access granted (200)

D No change in response

💡 Hint

Refer to variable_tracker and execution_table logic for key validation.

Concept Snapshot

API key authentication in Flask:
- Client sends API key in request header (e.g., 'X-API-KEY')
- Server extracts key from headers
- Server checks if key is in allowed keys set
- If valid, process request; else return 401 Unauthorized
- Simple, secure way to control API access

Full Transcript

This example shows how a Flask server uses API key authentication. The client includes an API key in the request header named 'X-API-KEY'. The server extracts this key and checks if it is in a set of valid keys. If the key matches, the server returns a success message. If the key is missing or incorrect, the server returns a 401 Unauthorized error. This method helps protect API endpoints by allowing only clients with valid keys to access them.

Practice

1. What is the main purpose of using an API key in Flask applications?

easy

A. To style the API output

B. To verify that the client is authorized to access the API

C. To speed up the API response time

D. To store user passwords securely

Solution

1. Step 1: Understand API key role

   An API key is a secret token sent by the client to prove identity.

2. Step 2: Identify purpose in Flask

   The server checks this key to allow or deny access to API resources.

3. Final Answer:

   To verify that the client is authorized to access the API -> Option B

4. Quick Check:

   API key = Authorization [OK]

Hint: API keys prove client identity to server [OK]

Common Mistakes:

• Thinking API keys speed up responses
• Confusing API keys with styling tools
• Using API keys to store passwords

2. Which of the following is the correct way to retrieve an API key from request headers in Flask?

easy

A. api_key = request.cookies.get('X-API-KEY')

B. api_key = request.args['X-API-KEY']

C. api_key = request.form['X-API-KEY']

D. api_key = request.headers.get('X-API-KEY')

Solution

1. Step 1: Identify where API keys are usually sent

   API keys are commonly sent in HTTP headers for security.

2. Step 2: Use Flask syntax to get header value

   Use request.headers.get('Header-Name') to safely retrieve header values.

3. Final Answer:

   api_key = request.headers.get('X-API-KEY') -> Option D

4. Quick Check:

   Headers use request.headers.get() [OK]

Hint: Use request.headers.get() for header values [OK]

Common Mistakes:

• Using request.args for headers
• Trying to get API key from form data
• Looking for API key in cookies

3. Given this Flask code snippet, what will be the response if the client sends a request with header X-API-KEY: wrongkey?

from flask import Flask, request, jsonify
app = Flask(__name__)

VALID_API_KEY = 'secret123'

@app.route('/data')
def data():
    api_key = request.headers.get('X-API-KEY')
    if api_key == VALID_API_KEY:
        return jsonify({'message': 'Access granted'})
    else:
        return jsonify({'error': 'Unauthorized'}), 401

medium

A. {"error": "Unauthorized"}

B. {"message": "Access granted"}

C. 500 Internal Server Error

D. Empty response with status 200

Solution

1. Step 1: Check API key comparison

   The code compares the header key to 'secret123'. 'wrongkey' does not match.

2. Step 2: Determine response for wrong key

   Since keys differ, the else block returns a JSON error with status 401.

3. Final Answer:

   {"error": "Unauthorized"} -> Option A

4. Quick Check:

   Wrong key = Unauthorized error [OK]

Hint: Wrong key triggers 401 Unauthorized JSON error [OK]

Common Mistakes:

• Assuming any key grants access
• Expecting 500 error for wrong key
• Thinking response is empty

4. Identify the error in this Flask API key check code:

from flask import Flask, request
app = Flask(__name__)

VALID_KEY = 'abc123'

@app.route('/info')
def info():
    api_key = request.headers['X-API-KEY']
    if api_key = VALID_KEY:
        return 'Access allowed'
    else:
        return 'Access denied', 403

medium

A. Using single equals (=) instead of double equals (==) in if condition

B. Accessing headers with request.headers.get() instead of []

C. Missing return type for response

D. Route decorator syntax is incorrect

Solution

1. Step 1: Check if condition syntax

   The if statement uses '=' which is assignment, not comparison.

2. Step 2: Correct comparison operator

   Use '==' to compare api_key and VALID_KEY for equality check.

3. Final Answer:

   Using single equals (=) instead of double equals (==) in if condition -> Option A

4. Quick Check:

   Comparison needs '==' not '=' [OK]

Hint: Use '==' for comparison, '=' is assignment [OK]

Common Mistakes:

• Confusing '=' with '==' in conditions
• Thinking request.headers['X-API-KEY'] is wrong
• Believing return type must be explicit

5. You want to protect multiple Flask routes using the same API key check without repeating code. Which approach is best to implement this efficiently?

hard

A. Copy the API key check code inside every route function

B. Check the API key only in the first route and assume others are safe

C. Create a decorator function that checks the API key before running the route function

D. Use a global variable to store the API key and skip checks

Solution

1. Step 1: Understand code reuse for API key checks

   Repeating code in every route is inefficient and error-prone.

2. Step 2: Use a decorator to wrap routes

   A decorator can run the API key check before the route logic, applying it to many routes cleanly.

3. Final Answer:

   Create a decorator function that checks the API key before running the route function -> Option C

4. Quick Check:

   Decorator = reusable API key check [OK]

Hint: Use decorators to avoid repeating API key checks [OK]

Common Mistakes:

• Copy-pasting code in every route
• Skipping checks on some routes
• Using global variables to bypass security