> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/fastapi/fastapi/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Authentication

> API key authentication using query parameters, headers, or cookies

## APIKeyQuery

API key authentication using a query parameter.

This defines the name of the query parameter that should be provided in the request with the API key and integrates that into the OpenAPI documentation. It extracts the key value sent in the query parameter automatically and provides it as the dependency result. But it doesn't define how to send that API key to the client.

### Parameters

<ParamField path="name" type="str" required>
  Query parameter name.
</ParamField>

<ParamField path="scheme_name" type="str | None" default="None">
  Security scheme name. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="description" type="str | None" default="None">
  Security scheme description. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="auto_error" type="bool" default="True">
  By default, if the query parameter is not provided, `APIKeyQuery` will automatically cancel the request and send the client an error.

  If `auto_error` is set to `False`, when the query parameter is not available, instead of erroring out, the dependency result will be `None`.

  This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in a query parameter or in an HTTP Bearer token).
</ParamField>

### Example

```python theme={null}
from fastapi import Depends, FastAPI
from fastapi.security import APIKeyQuery

app = FastAPI()

query_scheme = APIKeyQuery(name="api_key")

@app.get("/items/")
async def read_items(api_key: str = Depends(query_scheme)):
    return {"api_key": api_key}
```

***

## APIKeyHeader

API key authentication using a header.

This defines the name of the header that should be provided in the request with the API key and integrates that into the OpenAPI documentation. It extracts the key value sent in the header automatically and provides it as the dependency result. But it doesn't define how to send that key to the client.

### Parameters

<ParamField path="name" type="str" required>
  Header name.
</ParamField>

<ParamField path="scheme_name" type="str | None" default="None">
  Security scheme name. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="description" type="str | None" default="None">
  Security scheme description. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="auto_error" type="bool" default="True">
  By default, if the header is not provided, `APIKeyHeader` will automatically cancel the request and send the client an error.

  If `auto_error` is set to `False`, when the header is not available, instead of erroring out, the dependency result will be `None`.

  This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in a header or in an HTTP Bearer token).
</ParamField>

### Example

```python theme={null}
from fastapi import Depends, FastAPI
from fastapi.security import APIKeyHeader

app = FastAPI()

header_scheme = APIKeyHeader(name="x-key")

@app.get("/items/")
async def read_items(key: str = Depends(header_scheme)):
    return {"key": key}
```

***

## APIKeyCookie

API key authentication using a cookie.

This defines the name of the cookie that should be provided in the request with the API key and integrates that into the OpenAPI documentation. It extracts the key value sent in the cookie automatically and provides it as the dependency result. But it doesn't define how to set that cookie.

### Parameters

<ParamField path="name" type="str" required>
  Cookie name.
</ParamField>

<ParamField path="scheme_name" type="str | None" default="None">
  Security scheme name. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="description" type="str | None" default="None">
  Security scheme description. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="auto_error" type="bool" default="True">
  By default, if the cookie is not provided, `APIKeyCookie` will automatically cancel the request and send the client an error.

  If `auto_error` is set to `False`, when the cookie is not available, instead of erroring out, the dependency result will be `None`.

  This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in a cookie or in an HTTP Bearer token).
</ParamField>

### Example

```python theme={null}
from fastapi import Depends, FastAPI
from fastapi.security import APIKeyCookie

app = FastAPI()

cookie_scheme = APIKeyCookie(name="session")

@app.get("/items/")
async def read_items(session: str = Depends(cookie_scheme)):
    return {"session": session}
```