X-Secret-Key

core/schemas.py

@@ -8,8 +8,5 @@ class RegisterRequest(BaseModel):
     user_id: str = Field(..., min_length=1, description="Temporary user ID from frontend")
     email: EmailStr = Field(..., description="User email address")
 
-class ValidateRequest(BaseModel):
-    secret_key: str = Field(..., min_length=35, description="Secret key starting with sk_")
-
 class ResetRequest(BaseModel):
     email: EmailStr = Field(..., description="User email address")

routers/auth.py

@@ -1,4 +1,4 @@
-from fastapi import APIRouter, Depends, HTTPException, status, Request, BackgroundTasks
+from fastapi import APIRouter, Depends, HTTPException, status, Request, BackgroundTasks, Header
 from fastapi.responses import JSONResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
@@ -7,7 +7,7 @@ import uuid
 
 from core.database import get_db
 from core.models import User, AuditLog
-from core.schemas import CheckRegistrationRequest, RegisterRequest, ValidateRequest, ResetRequest
+from core.schemas import CheckRegistrationRequest, RegisterRequest, ResetRequest
 from core.security import get_password_hash, verify_password, generate_secret_key
 from services.email_service import send_email
 from dependencies import check_rate_limit
@@ -121,9 +121,9 @@ Do not share this key with anyone."""
 
 @router.post("/validate")
 async def validate_key(
-    request: ValidateRequest,
     req: Request,
     background_tasks: BackgroundTasks,
+    x_secret_key: str = Header(..., alias="X-Secret-Key"),
     db: AsyncSession = Depends(get_db)
 ):
     """
@@ -140,7 +140,7 @@ async def validate_key(
     
     valid_user = None
     for user in users:
-        if verify_password(request.secret_key, user.secret_key_hash):
+        if verify_password(x_secret_key, user.secret_key_hash):
             valid_user = user
             break
     

tests/test_integration.py

@@ -54,7 +54,7 @@ def test_credit_system_flow(mock_send_email, client):
         })
         
         # Validate
-        response = client.post("/auth/validate", json={"secret_key": "sk_test_key_1234567890123456789012345"})
+        response = client.post("/auth/validate", headers={"X-Secret-Key": "sk_test_key_1234567890123456789012345"})
         assert response.status_code == 200
         assert response.json()["valid"] == True
         assert response.json()["credits"] == 100