FastAPI: How Can I Enable Dual Authentication with API Key and Azure AD?

Below is one common solution: making the Azure AD dependency optional by wrapping it in a dependency that catches the auto‐error. That way, if you only supply an API key the azure dependency won’t automatically raise a 401, yet Swagger still “sees” the Azure auth scheme. For example:

PYTHONCopied
from fastapi import Depends, HTTPException, Request, Security
from fastapi.security import APIKeyHeader
from fastapi_azure_auth.auth import SingleTenantAzureAuthorizationCodeBearer
from fastapi_azure_auth.user import User
from typing import Optional

# Define your schemes:
azure_scheme = SingleTenantAzureAuthorizationCodeBearer(
    app_client_id=settings.azure_ad.app_client_id,
    tenant_id=settings.azure_ad.tenant_id,
    token_version=1,
    scopes={f"api://{settings.azure_ad.app_client_id}/user_impersonation": "user_impersonation"},
    # Keep auto_error True here so that swagger still picks up the authentication mechanism
)

# For API key, we already set auto_error to False:
api_key_scheme = APIKeyHeader(name="x-api-key", auto_error=False)

# Create an "optional" wrapper for Azure AD authentication.
async def optional_azure_token(request: Request) -> Optional[User]:
    try:
        # Call the azure_scheme dependency manually.
        return await azure_scheme(request)
    except HTTPException:
        # If no valid token is provided, return None instead of erroring.
        return None

def dual_authentication(
    api_key: Optional[str] = Security(api_key_scheme),
    azure_token: Optional[User] = Depends(optional_azure_token),
) -> User:
    """
    Authenticate via API key or Azure AD.
    """
    # Check for a valid API key.
    if _is_api_key_present_and_valid(api_key):
        return EXTERNAL_API_USER

    # Fall back to Azure AD authentication.
    if azure_token:
        return azure_token

    # If neither is valid, raise an error.
    raise HTTPException(status_code=401, detail="User not authenticated")

In this setup:

1. When you make a Swagger request and include an Azure AD Bearer token in the Authorization header, the azure_scheme correctly validates it (via the optional_azure_token wrapper) and returns a User.
2. When making a curl request with only the X-API-Key header, the API key validation will pass (if valid) and the azure dependency will return None.
3. Similarly, if you only provide the Authorization Bearer token (and no API key), authentication will succeed via Azure AD.

This pattern lets you support dual authentication without changing the OpenAPI documentation for Azure auth. Remember to adjust your validation function _is_api_key_present_and_valid and the constant EXTERNAL_API_USER as needed for your application.