apikee · Python

API key plugin for Python — FastAPI, Flask, and Starlette.

Install

pip install apikee                # local mode, zero deps
pip install "apikee[fastapi]"     # + FastAPI middleware
pip install "apikee[server]"      # + encrypted server channel
pip install "apikee[all]"         # everything
pip install --pre apikee          # latest beta pre-release

Configure

export APIKEE_SECRET=$(openssl rand -hex 32)

# Optional server mode — point to your self-hosted Apikee instance
export APIKEE_BASE_URL=https://apikee.example.com/api/v1
export APIKEE_SERVER_KEY=sk_...
export APIKEE_PROJECT_ENV=my-api-production

FastAPI

from apikee.fastapi import SecuredFastAPI, ApikeeDepends, require_scope
from apikee import ApikeeClaims
from fastapi import Depends

app = SecuredFastAPI()  # reads APIKEE_SECRET — done

@app.post("/keys")         # public endpoint — issue keys to customers
def create_key(tenant: str, scopes: str = "read,write"):
    key = app.apikee.create(tenant, scopes=scopes.split(","))
    return {"key": key}   # store it — returned once

@app.get("/data")
def get_data(claims: ApikeeClaims = ApikeeDepends()):
    return {"tenant": claims.tenant, "scopes": claims.scopes}

@app.delete("/admin", dependencies=[Depends(require_scope("admin"))])
def admin_action(): ...

Open /docs — every endpoint shows the 🔒 lock. Click Authorize, paste a key.

Flask

from flask import Flask
from apikee.flask import init_apikee, apikee_required, require_scope, get_claims

app = Flask(__name__)
init_apikee(app)  # reads APIKEE_SECRET — done

@app.get("/data")
@apikee_required
def data():
    return {"tenant": get_claims().tenant}

@app.delete("/admin")
@require_scope("admin")
def admin(): ...

Any ASGI

from apikee import Apikee

apikee = Apikee()
app.add_middleware(apikee.middleware)   # claims at request.state.apikee

# Or inline, no middleware:
claims = apikee.protect(request.headers.get("x-api-key"))

Key rotation (zero downtime)

export APIKEE_SECRET=new-secret        # new keys signed with this
# Old keys still validate during the rotation window — pass both to Apikee():

apikee = Apikee(secrets=["new-secret", "old-secret"])

Environment Variables (.env)

Python frameworks (FastAPI, Flask, Starlette/ASGI) use the same variables.

Required:

APIKEE_SECRET=replace-with-strong-random-secret

Optional (server mode — requires a running Apikee instance):

APIKEE_BASE_URL=https://apikee.example.com/api/v1
APIKEE_SERVER_KEY=sk_...
APIKEE_PROJECT_ENV=my-api-production
APIKEE_SERVER_PUBLIC_KEY=base64-x25519-public-key   # enables payload encryption
APIKEE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----..."  # enables RSA request signing

Project structure

apikee/     Library source — core + framework modules (FastAPI, Flask, server)
tests/      Test suite
examples/   Example apps (FastAPI, Flask, Starlette)

Contributing

See CONTRIBUTING.md for local setup, branch naming conventions, and the release process.

License

MIT

Docs

github.com/apikee-dev