Flagsmith / Flagsmith/flagsmith

Not all API routes cannot be called with Api-Key auth prefix

Open
#5,146 0 comments 0 reactions 1 assignee Claimed by @gagantrivedi View on GitHub
api
Dominant language
Python
Stars
6.6k
Forks
567
Avg merge
1d 13h
Merged PRs (30d)
121

Description

### How are you running Flagsmith

- [x] Self Hosted with Docker
- [x] Self Hosted with Kubernetes
- [x] SaaS at flagsmith.com
- [ ] Some other way (add details in description below)

### Describe the bug

According to our [API docs](https://docs.flagsmith.com/clients/rest/#private-admin-api-endpoints), workflows endpoints such as [Get change request by ID](https://api.flagsmith.com/api/v1/docs/#/api/api_v1_features_workflows_change-requests_read) can be called with an Admin API key. However, calling them with `Authorization: Api-Key ...` returns a 401:

```
{"detail":"Valid Master API Key not found."}
```

### Steps To Reproduce

```
curl 'https://api.flagsmith.com/api/v1/features/workflows/change-requests/8048/' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0' -H 'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.7,es-AR;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' -H 'Referer: https://app.flagsmith.com/' -H 'AUTHORIZATION: Api-Key ...' -H 'Origin: https://app.flagsmith.com' -H 'Connection: keep-alive' -H 'Sec-Fetch-Dest: empty' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-site' -H 'Priority: u=0' -H 'TE: trailers'
```

### Expected behavior

Accept both `Api-Key` and `Token` prefixes for all Admin API endpoints.

### Screenshots

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.