From 2fc297f4825f7ee9f93a415c964e7873a42f92db Mon Sep 17 00:00:00 2001
From: imeepos <imeepos@outlook.com>
Date: Thu, 11 Jun 2026 21:11:02 -0700
Subject: [PATCH] fix: use x-api-key for api key sessions

---
 src/plugins.ts            | 10 ++++++++++
 tests/auth-config.test.ts | 32 +++++++++++++++++++++++++++++++-
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/src/plugins.ts b/src/plugins.ts
index ac47b96..9e5cdb5 100644
--- a/src/plugins.ts
+++ b/src/plugins.ts
@@ -25,6 +25,10 @@ import { createGenericOAuthProviders } from "./oauth";
 import { authPerformanceConfig } from "./performance";
 import { buildAuthSms, sendSms } from "./sms";
 
+type ApiKeyGetterContext = {
+  headers?: Headers;
+};
+
 export function createApiKeyConfigurations(env: Env) {
   const performance = authPerformanceConfig(env);
 
@@ -34,6 +38,8 @@ export function createApiKeyConfigurations(env: Env) {
       defaultPrefix: "cfw_",
       requireName: true,
       enableMetadata: true,
+      enableSessionForAPIKeys: true,
+      customAPIKeyGetter: (ctx: ApiKeyGetterContext) => getApiKeyFromRequestHeaders(ctx.headers),
       deferUpdates: performance.apiKeyDeferUpdates,
       rateLimit: {
         enabled: true,
@@ -57,6 +63,10 @@ export function createApiKeyConfigurations(env: Env) {
   ];
 }
 
+export function getApiKeyFromRequestHeaders(headers: Headers | undefined): string | null {
+  return headers?.get("x-api-key") ?? null;
+}
+
 export function createAuthPlugins(env: Env): BetterAuthPlugin[] {
   const plugins: BetterAuthPlugin[] = [
     openAPI(),
diff --git a/tests/auth-config.test.ts b/tests/auth-config.test.ts
index 983239f..3ecec48 100644
--- a/tests/auth-config.test.ts
+++ b/tests/auth-config.test.ts
@@ -11,7 +11,11 @@ import {
 import { buildAuthEmail, sendEmail } from "../src/email";
 import { createGenericOAuthProviders, createSocialProviders } from "../src/oauth";
 import { authPerformanceConfig } from "../src/performance";
-import { createApiKeyConfigurations, createAuthPlugins } from "../src/plugins";
+import {
+  createApiKeyConfigurations,
+  createAuthPlugins,
+  getApiKeyFromRequestHeaders,
+} from "../src/plugins";
 import { buildAuthSms, sendSms } from "../src/sms";
 
 const env: Env = {
@@ -237,6 +241,32 @@ describe("auth plugins", () => {
     );
   });
 
+  it("enables API keys as get-session credentials only from x-api-key", () => {
+    const configurations = createApiKeyConfigurations({
+      BETTER_AUTH_URL: "http://localhost:8788",
+      TRUSTED_ORIGINS: "http://localhost:8787",
+    });
+
+    expect(configurations).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          configId: "default",
+          enableSessionForAPIKeys: true,
+          customAPIKeyGetter: expect.any(Function),
+        }),
+      ]),
+    );
+    expect(getApiKeyFromRequestHeaders(new Headers({ "x-api-key": "cfw_secret" }))).toBe(
+      "cfw_secret",
+    );
+    expect(
+      getApiKeyFromRequestHeaders(new Headers({ authorization: "Bearer cfw_secret" })),
+    ).toBeNull();
+    expect(
+      getApiKeyFromRequestHeaders(new Headers({ authorization: "Bearer better-auth-session" })),
+    ).toBeNull();
+  });
+
   it("allows disabling api key deferred updates", () => {
     const configurations = createApiKeyConfigurations({
       BETTER_AUTH_URL: "http://localhost:8788",