Forem: Guillermo Olcina Martínez

How to Protect Your FastAPI Public API with API Keys

Guillermo Olcina Martínez — Tue, 05 Aug 2025 10:32:34 +0000

FastAPI is a powerful web framework for building APIs quickly and efficiently in Python. But once your API is public, you’ll want to protect it from abuse. One simple and effective way is using API Keys.

In this post, I’ll show you how to set up basic API Key validation in FastAPI.

🔐 Why API Keys?

API Keys let you:

Identify the client making requests
Limit usage (rate limiting, quota)
Disable keys without affecting others
Secure endpoints behind access controls

🛠️ Step 1: Define Your API Key Dependency

We'll use FastAPI's dependency injection system to require API keys on specific routes.

from fastapi import FastAPI, Depends, HTTPException, Header, status

app = FastAPI()

API_KEYS = {"123456", "abcdef", "my-secret-key"}  # Normally load this from a database or environment

def verify_api_key(x_api_key: str = Header(...)):
    if x_api_key not in API_KEYS:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or missing API Key"
        )

@app.get("/public")
def public_endpoint():
    return {"message": "This is public"}

@app.get("/protected", dependencies=[Depends(verify_api_key)])
def protected_endpoint():
    return {"message": "You have access with a valid API key"}

🧪 Testing

You can test it with curl or Postman:

curl http://localhost:8000/protected -H "x-api-key: 123456"

If the key is valid, you’ll get access. Otherwise, a 401 Unauthorized response.

📦 Optional: Use Limitly to Manage Keys, Limits & Plans

If you're building a commercial API and want to manage API keys, track usage, and set limits without building it from scratch — check out Limitly.

It’s a plug-and-play API access manager that works great with FastAPI.

🚀 Final Thoughts

This approach is simple and scalable for small to medium APIs. For more advanced use cases, you can:

Store keys in a database
Add rate-limiting
Track usage per key
Disable compromised keys dynamically

Protect your API early — it’s better than handling abuse later.

Happy coding! 🧑‍💻

How to Secure Your Public API in Next.js Using API Keys

Guillermo Olcina Martínez — Tue, 05 Aug 2025 10:30:44 +0000

Exposing API routes publicly in your Next.js app can be dangerous if you don't protect them properly. If you're building something like a public-facing SaaS, internal tools, or microservices, validating API keys is a simple and effective way to protect your endpoints.

In this post, you'll learn how to secure your /api routes using API keys with minimal code.

🔐 Step 1: Generate and store your API keys

In a real-world scenario, you'd generate an API key for each client/user and store it securely in your database. But for the purpose of this example, we'll hardcode a key.

// lib/validateApiKey.ts
export const isValidApiKey = (key?: string) => {
  const validKeys = [process.env.INTERNAL_API_KEY];
  return key && validKeys.includes(key);
};

Don't forget to set your INTERNAL_API_KEY in .env.local:

INTERNAL_API_KEY=your-secret-key

🧩 Step 2: Add middleware to protect routes

Next.js supports Edge Middleware and route handlers. For this guide, we'll use a simple pattern in an API route:

// pages/api/secure.ts
import type { NextApiRequest, NextApiResponse } from 'next';
import { isValidApiKey } from '@/lib/validateApiKey';

export default function handler(req: NextApiRequest, res: NextApiResponse) {
  const apiKey = req.headers['x-api-key'] as string;

  if (!isValidApiKey(apiKey)) {
    return res.status(401).json({ message: 'Unauthorized' });
  }

  res.status(200).json({ message: 'Access granted 🎉' });
}

You can now test it using curl or Postman:

curl -H "x-api-key: your-secret-key" http://localhost:3000/api/secure

✅ Best Practices

Use a proper database to store keys, and hash them if possible.
Rotate and expire keys.
Assign scopes or permissions to different API keys.
Monitor usage and rate limit requests per key.

🛠️ Looking for a managed solution?

If you're building a SaaS or API-first product and don't want to handle all of this manually, check out Limitly. It helps you manage API keys, enforce rate limits, and track usage — all via a simple SDK.

Happy building! 🚀

🔐 How to Protect Your Public Express API Using API Keys

Guillermo Olcina Martínez — Tue, 05 Aug 2025 10:26:52 +0000

If you're building an API in Express.js and plan to expose it publicly — maybe to clients, third-party devs, or internal tools — you need some way to control access.

One of the most common and effective ways to do this is using API keys.

In this post, I’ll walk you through a simple way to implement API key protection in your Express API. No fancy gateways, no unnecessary bloat — just straightforward logic you can build on.

🚧 Why API Keys?

API keys are unique tokens (usually strings) that your users include in their requests. You can:

Identify who's calling your API.
Set limits (like 1,000 requests per day).
Revoke keys if needed.
Analyze usage by key/project/client.

Perfect for public or semi-public APIs that don’t need full OAuth complexity.

🛠️ Basic API Key Middleware in Express

Here’s a minimal implementation:

// middleware/apiKey.js
const validApiKeys = [
  'abc123', // In real use, store these in a DB
  'def456',
];

export function apiKeyMiddleware(req, res, next) {
  const apiKey = req.header('x-api-key');

  if (!apiKey || !validApiKeys.includes(apiKey)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  next();
}

And in your Express app:

import express from 'express';
import { apiKeyMiddleware } from './middleware/apiKey.js';

const app = express();

app.use('/api', apiKeyMiddleware);

app.get('/api/data', (req, res) => {
  res.json({ message: 'Hello, world!' });
});

app.listen(3000, () => console.log('Server running on port 3000'));

🧠 A Few Tips

Store API keys in a database (with metadata like usage, owner, status).
Add rate limiting to prevent abuse.
Consider rotating keys over time.
Log each request to track usage per key.

⚡ Want to Skip the Boilerplate?

If you don’t want to build all this from scratch, you can use a tool like Limitly — it handles API key creation, validation, usage limits (daily, weekly, etc.), and request tracking with an SDK you can plug into your Express app.

I built it because I was tired of reinventing this every time I launched an API.

Let me know if you use a different method or have feedback — always happy to learn new approaches!

Supadex: A Mobile Dashboard for Supabase Developers 🚀

Guillermo Olcina Martínez — Wed, 11 Jun 2025 10:13:45 +0000

Hey DEV community! 👋

If you’re building apps with Supabase, you know how powerful it is as a Postgres-based backend. But what if you could monitor and manage your Supabase projects directly from your phone?

That’s exactly why I built Supadex — a mobile companion for developers who want real-time visibility and control over their Supabase instances, even when they’re away from their laptop.

🚦 Why Supadex?

Supabase is amazing, but if you've ever tried to quickly check a query result or manage a storage bucket while commuting or in a meeting, you know it's not super mobile-friendly.

Supadex solves that.

With Supadex, you get a native mobile dashboard that connects securely to your Supabase projects and offers:

🔍 Real-time Analytics: Keep an eye on REST and Auth requests, track usage, and monitor active users — all from your phone.
🗃️ Database Management: Browse tables, write SQL, save your favorite queries, and run them on the go.
📁 Storage Tools: Navigate buckets, manage files, share public URLs — faster than opening your laptop.
🔒 Privacy-first Approach: Tokens are stored locally only. No data collection, no tracking. You stay in control.
⚙️ Developer Quality of Life: Multi-project support, dark mode, and real-time updates with a smooth interface.

👨‍💻 Who is Supadex for?

Supabase developers (obviously)
Backend engineers working remotely or on-call
DevOps folks who need to check logs/stats quickly
Full-stack devs who don’t want to SSH into a VPS just to check a DB
Anyone who builds side-projects and wants easy access to Supabase on mobile

📲 Pricing

Supadex is a premium tool, but it comes with flexible options:

$3.99/month
$39.99/year
Or a $79.99 lifetime plan

Think of it as paying for peace of mind (and fewer rushed logins to the Supabase web UI in weird places 😅).

🔗 Try it out

If you use Supabase regularly and want more control on the go, give Supadex a try. I’d love your feedback or suggestions — I’m actively improving it!

→ Download Supadex on the App Store 🍎

→ Download Supadex on the Play Store 🤖

→ Visit the website

Let me know what you think — happy to answer any questions or dive into how I built it, if that’s helpful!

Cheers,

– Guillermo Olcina 🧑‍💻