Does ApiKey security scheme supports multiple keys?

[Kinrany]

OpenAPI 3.0 spec describes an option to have multiple API keys required at the same time: https://swagger.io/docs/specification/authentication/api-keys/#multiple

Does utoipa::openapi::security::ApiKey support this?

[Paracetamol56]

Hello,
Yes, you can use a struct implementing the utoipa::Modify trait as you would with a single API key. Inside, you can call 2 times the function add_security_scheme(&mut self, name: N, security_schema: S) on the component like so:

struct SecurityAddon;

impl Modify for SecurityAddon {
    fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
        let components = openapi.components.as_mut().unwrap();
        components.add_security_scheme(
            "apiKey",
            SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("X-API-KEY"))),
        );
        components.add_security_scheme(
            "appId",
            SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("X-APP-ID"))),
        );
    }
}

Finally, you can pass this modifier to your OpenAPI proc macro like this:

#[derive(OpenApi)]
#[openapi(
    // [...]
    modifiers(&SecurityAddon),
)]
struct ApiDoc;

Result

"securitySchemes": {
  "apiKey": {
    "type": "apiKey",
    "in": "header",
    "name": "X-API-KEY"
  },
  "appId": {
    "type": "apiKey",
    "in": "header",
    "name": "X-APP-ID"
  }
}

[Kinrany]

Wouldn't that be two alternative schemas? The intent here is to require two headers being set at the same time.

Perhaps the difference is only at the level of applying security schemas to endpoints? The OpenAPI doc linked above describes this difference between multiple alternative schemas and a single schema with multiple headers as:

# one of the two is required
security:
  - apiKey: []
  - appId: []

# both are required
security:
  - apiKey: []
    appId: []

Similarly, utoipa::path currently accepts security(("apiKey" = []), ("appId" = [])), but the docs mention no option that would be similar to security(("apiKey" = [], "appId" = [])).

[Paracetamol56]

Yep, I'm afraid the utoipa::openapi::security::SecurityRequirement object doesn't accept more than one security scheme in its implementation.

Only one of the requirements must be satisfied.

https://docs.rs/utoipa/latest/utoipa/openapi/security/struct.SecurityRequirement.html