APIKeyBase Class — fastapi Architecture

Architecture documentation for the APIKeyBase class in api_key.py from the fastapi codebase.

Class python Security

Entity Profile

Security→ APIKeyBase Class — fastapi Architecture

Dependency Diagram

graph TD
  f01173ae_dbd6_605b_f92e_0035a743c419["APIKeyBase"]
  28c8873a_5ba4_867f_0824_7abcac157a85["SecurityBase"]
  f01173ae_dbd6_605b_f92e_0035a743c419 -->|extends| 28c8873a_5ba4_867f_0824_7abcac157a85
  fac63c1f_ae18_a88d_487c_0fd6cfe587f0["api_key.py"]
  f01173ae_dbd6_605b_f92e_0035a743c419 -->|defined in| fac63c1f_ae18_a88d_487c_0fd6cfe587f0
  77841233_17c1_33cd_0da9_bee86f06d880["__init__()"]
  f01173ae_dbd6_605b_f92e_0035a743c419 -->|method| 77841233_17c1_33cd_0da9_bee86f06d880
  8b39fe4e_79da_b187_f689_d2d00b0a2dd6["make_not_authenticated_error()"]
  f01173ae_dbd6_605b_f92e_0035a743c419 -->|method| 8b39fe4e_79da_b187_f689_d2d00b0a2dd6
  0a1afb2c_f4ce_fb90_4faf_3674ab253100["check_api_key()"]
  f01173ae_dbd6_605b_f92e_0035a743c419 -->|method| 0a1afb2c_f4ce_fb90_4faf_3674ab253100

Relationship Graph

Source Code

fastapi/security/api_key.py lines 11–50

class APIKeyBase(SecurityBase):
    def __init__(
        self,
        location: APIKeyIn,
        name: str,
        description: Union[str, None],
        scheme_name: Union[str, None],
        auto_error: bool,
    ):
        self.auto_error = auto_error

        self.model: APIKey = APIKey(
            **{"in": location},
            name=name,
            description=description,
        )
        self.scheme_name = scheme_name or self.__class__.__name__

    def make_not_authenticated_error(self) -> HTTPException:
        """
        The WWW-Authenticate header is not standardized for API Key authentication but
        the HTTP specification requires that an error of 401 "Unauthorized" must
        include a WWW-Authenticate header.

        Ref: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized

        For this, this method sends a custom challenge `APIKey`.
        """
        return HTTPException(
            status_code=HTTP_401_UNAUTHORIZED,
            detail="Not authenticated",
            headers={"WWW-Authenticate": "APIKey"},
        )

    def check_api_key(self, api_key: Optional[str]) -> Optional[str]:
        if not api_key:
            if self.auto_error:
                raise self.make_not_authenticated_error()
            return None
        return api_key