API key authentication concept in Flask - Step-by-Step Execution

Concept Flow - API key authentication concept

Client sends request with API key

↓

Server receives request

↓

Extract API key from headers

↓

Check if API key is valid?

No→Reject request with 401

Yes↓

Process request and send response

The server checks the API key sent by the client in the request headers. If valid, it processes the request; otherwise, it rejects it.

Execution Sample

Flask

from flask import Flask, request, jsonify
app = Flask(__name__)
API_KEYS = {"abc123"}

@app.route('/data')
def data():
    key = request.headers.get('X-API-KEY')
    if key in API_KEYS:
        return jsonify({"message": "Access granted"})
    return jsonify({"error": "Unauthorized"}), 401

A Flask route that checks for a valid API key in the request headers and returns access or error.

Execution Table

Step	Action	API Key Extracted	API Key Valid?	Response
1	Client sends request with header X-API-KEY='abc123'	abc123	Yes	Access granted (200)
2	Client sends request with header X-API-KEY='wrongkey'	wrongkey	No	Unauthorized (401)
3	Client sends request without X-API-KEY header	None	No	Unauthorized (401)

💡 Requests without valid API key are rejected with 401 Unauthorized.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3
key	None	abc123	wrongkey	None
API_KEYS	{'abc123'}	{'abc123'}	{'abc123'}	{'abc123'}

Key Moments - 2 Insights

Why does the server reject the request if the API key is missing?

Because the extracted API key is None (see execution_table step 3), which is not in the set of valid API keys, so the server returns 401 Unauthorized.

What happens if the API key is incorrect but present?

The server checks the key against the valid keys (execution_table step 2). Since it is not found, the server rejects the request with 401 Unauthorized.

Visual Quiz - 3 Questions

Look at the execution table, what is the response when the API key is 'abc123'?

A Unauthorized (401)

B Access granted (200)

C Server error (500)

D No response

💡 Hint

Check the row where API Key Extracted is 'abc123' in the execution_table.

At which step does the API key extracted become None?

A Step 3

B Step 1

C Step 2

D Never

💡 Hint

Look at the 'API Key Extracted' column in the execution_table.

If we add another valid key 'xyz789' to API_KEYS, what would happen at step 2 if the client sends 'xyz789'?

A Response would be Unauthorized (401)

B Server would crash

C Response would be Access granted (200)

D No change in response

💡 Hint

Refer to variable_tracker and execution_table logic for key validation.

Concept Snapshot

API key authentication in Flask:
- Client sends API key in request header (e.g., 'X-API-KEY')
- Server extracts key from headers
- Server checks if key is in allowed keys set
- If valid, process request; else return 401 Unauthorized
- Simple, secure way to control API access

Full Transcript

This example shows how a Flask server uses API key authentication. The client includes an API key in the request header named 'X-API-KEY'. The server extracts this key and checks if it is in a set of valid keys. If the key matches, the server returns a success message. If the key is missing or incorrect, the server returns a 401 Unauthorized error. This method helps protect API endpoints by allowing only clients with valid keys to access them.