1. What is API Security?

API security protects an API from unauthorized access. Without authentication:

Client
  ↓
FastAPI
  ↓
API Response

Anyone who knows the API URL may be able to access it. With API key authentication:

Client
  ↓
API Key
  ↓
FastAPI
  ↓
Authentication
  ↓
API Response

2. What is an API Key?

An API key is a secret value used to identify or authorize an API request. Example:

X-API-Key: my-secret-key

The server checks whether the provided key is valid.

Correct API Key
      ↓
   Allow


Incorrect API Key
      ↓
   Reject

3. API Key Header

A common approach is to send the API key using an HTTP header.

X-API-Key: my-secret-key

Example request:

GET /secret
X-API-Key: my-secret-key

FastAPI can read the header and validate it.

4. Why Use API Keys?

API keys can be used to:

Protect private APIs
Identify clients
Restrict unauthorized requests
Control access to services
Provide simple authentication

API keys are useful for simple applications, but production systems may require stronger authentication mechanisms such as OAuth 2.0 or JWT.

5. Never Hardcode Real API Keys

Avoid storing real secrets directly in Python code. Bad:

API_KEY = "my-real-secret-key"

Better:

Environment Variable
        ↓
Application

Example:

API_KEY=secret-value

The application reads the value from the environment.

6. What is Encryption?

Encryption converts readable data into an unreadable form.

Plaintext
   ↓
Encryption
   ↓
Ciphertext

Example:

Secret:
"my password"

       ↓

Encrypted:
"gAAAAAB..."

Only someone with the correct key can decrypt the encrypted data.

7. Encryption at Rest

Encryption at rest protects data while it is stored. Examples:

Database
Files
Backups
Storage

Architecture:

Application
     ↓
Encrypt
     ↓
Encrypted Storage

When the data is needed:

Encrypted Storage
     ↓
Decrypt
     ↓
Application

8. Encryption vs Hashing

These concepts are different.

Encryption	Hashing
Reversible	One-way
Can decrypt data	Cannot normally reverse
Used for secrets/data	Used for passwords/checksums
Requires encryption key	Uses hash algorithm

For example:

Encryption:

Secret
 ↓
Encrypted Data
 ↓
Secret

Hashing:

Password
 ↓
Hash

The original password is not recovered from the hash.

9. Fernet Encryption

For a simple Python demonstration, cryptography provides Fernet symmetric encryption. Install:

pip install fastapi uvicorn cryptography

Fernet uses the same secret key for encryption and decryption.

Encryption Key
     ↓
Encrypt ← Data → Decrypt
     ↓             ↓
Encrypted       Original

10. `security_demo.py`

import os

from cryptography.fernet import Fernet
from fastapi import FastAPI, Header, HTTPException
from pydantic import BaseModel


# Create FastAPI application
app = FastAPI(
    title="Security Demo",
    description="API key authentication and encryption demo"
)


# Get API key from environment variable
API_KEY = os.getenv(
    "API_KEY",
    "demo-api-key"
)


# Create or load encryption key
ENCRYPTION_KEY = os.getenv(
    "ENCRYPTION_KEY"
)

if ENCRYPTION_KEY is None:
    ENCRYPTION_KEY = Fernet.generate_key().decode()


# Create encryption object
fernet = Fernet(
    ENCRYPTION_KEY.encode()
)


# Define request schema
class SecretRequest(BaseModel):
    secret: str


# Check API key
def verify_api_key(api_key: str):

    if api_key != API_KEY:
        raise HTTPException(
            status_code=401,
            detail="Invalid API key"
        )


# Root endpoint
@app.get("/")
def root():

    return {
        "message": "Security Demo API is running"
    }


# Protected endpoint
@app.get("/protected")
def protected(
    x_api_key: str = Header(...)
):

    verify_api_key(x_api_key)

    return {
        "message": "Access granted"
    }


# Encrypt secret data
@app.post("/encrypt")
def encrypt_secret(
    request: SecretRequest,
    x_api_key: str = Header(...)
):

    verify_api_key(x_api_key)

    encrypted_secret = fernet.encrypt(
        request.secret.encode()
    ).decode()

    return {
        "encrypted_secret": encrypted_secret
    }

11. Run the API

uvicorn security_demo:app --reload

Open:

http://127.0.0.1:8000/docs

The Swagger UI can be used to test the API.

12. Setting the API Key

Windows PowerShell

$env:API_KEY="my-secret-key"

Then run:

uvicorn security_demo:app --reload

Windows CMD

set API_KEY=my-secret-key

Then:

uvicorn security_demo:app --reload

13. Testing API Authentication

The protected endpoint is:

GET /protected

With the correct header:

X-API-Key: my-secret-key

Response:

{
    "message": "Access granted"
}

With an incorrect key:

X-API-Key: wrong-key

Response:

{
    "detail": "Invalid API key"
}

HTTP status:

401 Unauthorized

14. Testing Encryption

Send:

{
    "secret": "my confidential data"
}

with the API key. The API returns something similar to:

{
    "encrypted_secret": "gAAAAAB..."
}

The encrypted value cannot be directly understood as the original text.

15. Encryption Flow

"my confidential data"
          ↓
       Fernet
          ↓
"gAAAAAB..."
          ↓
       Storage

When the original data is required:

"gAAAAAB..."
          ↓
       Fernet
          ↓
"my confidential data"

16. Important Security Concepts

Authentication

Determines who is allowed to access the API.

API Key
  ↓
Authentication

Authorization

Determines what an authenticated user is allowed to access.

Authenticated User
        ↓
Authorization
        ↓
Allowed Resources

Encryption

Protects data from being readable if someone gains access to the stored ciphertext.

Plaintext
   ↓
Encryption
   ↓
Ciphertext

17. API Key vs Encryption

These solve different problems.

API Key
  ↓
Protects API access


Encryption
  ↓
Protects stored data

They can be used together:

Client
  ↓
API Key
  ↓
FastAPI
  ↓
Authentication
  ↓
Encrypted Data
  ↓
Storage

18. Basic Security Best Practices

Use HTTPS

API keys should not normally be transmitted over plain HTTP in production.

HTTPS
  ↓
Encrypted communication

Store secrets securely

Use environment variables or a secrets manager instead of putting real keys directly in source code.

Rotate API keys

Replace keys periodically or when compromise is suspected.

Validate input

Use Pydantic models to validate API requests.

Avoid logging secrets

Do not print API keys, passwords, tokens, or decrypted confidential data in application logs.

19. Local Security Architecture

Client
  ↓
X-API-Key
  ↓
FastAPI
  ↓
Verify API Key
  ↓
Protected Endpoint
  ↓
Encrypt Secret
  ↓
Encrypted Data

20. Main Learning

Security & Privacy
        ↓
API Authentication
        ↓
API Key
        ↓
Request Validation
        ↓
Encryption
        ↓
Encrypted Data at Rest
        ↓
Secure Storage

Key takeaway: API key authentication controls access to the FastAPI service, while encryption protects sensitive data when it is stored. For production systems, HTTPS, secure secret management, key rotation, proper authentication, and access controls should also be used.

​1. What is API Security?

​2. What is an API Key?

​3. API Key Header

​4. Why Use API Keys?

​5. Never Hardcode Real API Keys

​6. What is Encryption?

​7. Encryption at Rest

​8. Encryption vs Hashing

​9. Fernet Encryption

​10. security_demo.py

​11. Run the API

​12. Setting the API Key

​Windows PowerShell

​Windows CMD

​13. Testing API Authentication

​14. Testing Encryption

​15. Encryption Flow

​16. Important Security Concepts

​Authentication

​Authorization

​Encryption

​17. API Key vs Encryption

​18. Basic Security Best Practices

​Use HTTPS

​Store secrets securely

​Rotate API keys

​Validate input

​Avoid logging secrets

​19. Local Security Architecture

​20. Main Learning