API key authentication quickstart

This gets you a signed, scoped, expiring API key and a route that rejects anything else — in local mode, so there is nothing to deploy and no account to make.

1. Set a signing secretCopy Anchor Link

Every SDK reads the same variable. Keys signed with this secret verify in any service that shares it.

export APIKEE_SECRET=$(openssl rand -hex 32)

2. Protect a routeCopy Anchor Link

from apikee.fastapi import SecuredFastAPI, ApikeeDepends
from apikee import ApikeeClaims

app = SecuredFastAPI()   # reads APIKEE_SECRET

@app.get("/v1/users")
def list_users(claims: ApikeeClaims = ApikeeDepends()):
    return {"tenant": claims.tenant}

3. Issue a keyCopy Anchor Link

from apikee import Apikee

apikee = Apikee()
key = apikee.create("acme", scopes=["read:users"], expires_in="90d")
print(key)   # apikee_… — shown once, store it now

4. Call itCopy Anchor Link

curl http://localhost:8000/v1/users -H "x-api-key: apikee_..."
# {"tenant":"acme"}

curl http://localhost:8000/v1/users -H "x-api-key: nonsense"
# 401 {"error":"INVALID_KEY"}

That is the whole local-mode loop. No database was touched and no network request left your process.

Requiring a scopeCopy Anchor Link

Verification proves the key is valid. Scopes decide what it may do.

from apikee.fastapi import require_scope
from fastapi import Depends

@app.delete("/v1/users/{id}", dependencies=[Depends(require_scope("admin"))])
def delete_user(id: str): ...

Read more in Scopes.

Next: connect the platformCopy Anchor Link

Local mode cannot revoke a key, count a request, or show you who is calling what — the key is self-contained, so nothing central knows about it. Adding the platform keeps the same fast local check and layers those on top.