Skip to content

pixano_inference.security

API-key authentication for the inference server.

Authentication is optional: if no keys are configured (PIXANO_INFERENCE_API_KEYS), the dependency is a no-op and a warning is emitted once at startup. When keys are set, every guarded route requires a matching key supplied as either an X-API-Key header or an Authorization: Bearer <key> header. Comparison is constant-time.

make_api_key_dependency(settings)

Build a FastAPI dependency enforcing API-key auth for the given settings.

Parameters:

Name Type Description Default
settings ServerSettings

Server settings holding the accepted API keys.

 required

Returns:

Type Description

An async dependency callable. It is a no-op when no keys are configured.
Source code in pixano_inference/security.py 
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
def make_api_key_dependency(settings: ServerSettings):
    """Build a FastAPI dependency enforcing API-key auth for the given settings.

    Args:
        settings: Server settings holding the accepted API keys.

    Returns:
        An async dependency callable. It is a no-op when no keys are configured.
    """
    accepted = list(settings.api_keys)

    async def require_api_key(
        x_api_key: str | None = Header(default=None, alias="X-API-Key"),
        authorization: str | None = Header(default=None),
    ) -> None:
        if not accepted:
            return
        presented = _extract_key(x_api_key, authorization)
        if presented is None:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Missing API key. Supply 'X-API-Key' or 'Authorization: Bearer <key>'.",
                headers={"WWW-Authenticate": "Bearer"},
            )
        if not _key_matches(presented, accepted):
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid API key.")

    return require_api_key

warn_if_auth_disabled(settings, host)

Emit a startup warning when auth is off, escalating on a non-loopback bind.

Source code in pixano_inference/security.py 
78
79
80
81
82
83
84
85
86
87
88
89
90
def warn_if_auth_disabled(settings: ServerSettings, host: str) -> None:
    """Emit a startup warning when auth is off, escalating on a non-loopback bind."""
    if settings.auth_enabled:
        return
    is_loopback = host in {"127.0.0.1", "localhost", "::1"}
    message = (
        "API-key authentication is DISABLED (no PIXANO_INFERENCE_API_KEYS configured). "
        "Every inference and admin endpoint is open to anyone who can reach the server."
    )
    if is_loopback:
        logger.warning(message)
    else:
        logger.error("%s The server is binding a non-loopback host (%s).", message, host)