Expose api key validation

tests/test_api_keys.py

@@ -0,0 +1,46 @@
+import pytest
+
+from tests.utils.fixtures.mock_api_key import MockApiKey
+from tests.utils.syncify import syncify
+from workos.api_key import ApiKey, AsyncApiKey
+from workos.exceptions import AuthenticationException
+
+
+@pytest.mark.sync_and_async(ApiKey, AsyncApiKey)
+class TestApiKey:
+    @pytest.fixture
+    def mock_api_key_details(self):
+        api_key_details = MockApiKey()
+        return api_key_details.model_dump()
+
+    def test_validate_api_key_with_valid_key(
+        self,
+        module_instance,
+        mock_api_key_details,
+        capture_and_mock_http_client_request,
+    ):
+        request_kwargs = capture_and_mock_http_client_request(
+            module_instance._http_client, mock_api_key_details, 200
+        )
+
+        api_key_details = syncify(module_instance.validate_api_key())
+
+        assert request_kwargs["url"].endswith("/api_keys/validate")
+        assert request_kwargs["method"] == "post"
+        assert api_key_details.id == mock_api_key_details["id"]
+        assert api_key_details.name == mock_api_key_details["name"]
+        assert api_key_details.object == "api_key"
+
+    def test_validate_api_key_with_invalid_key(
+        self,
+        module_instance,
+        mock_http_client_with_response,
+    ):
+        mock_http_client_with_response(
+            module_instance._http_client,
+            {"message": "Invalid API key", "error": "invalid_api_key"},
+            401,
+        )
+
+        with pytest.raises(AuthenticationException):
+            syncify(module_instance.validate_api_key())

tests/test_client.py

@@ -37,6 +37,9 @@ def test_client_with_api_key_and_client_id_environment_variables(self):
         os.environ.pop("WORKOS_API_KEY")
         os.environ.pop("WORKOS_CLIENT_ID")
 
+    def test_initialize_api_keys(self, default_client):
+        assert bool(default_client.api_keys)
+
     def test_initialize_sso(self, default_client):
         assert bool(default_client.sso)
 
@@ -112,6 +115,9 @@ def test_client_with_api_key_and_client_id_environment_variables(self):
         os.environ.pop("WORKOS_API_KEY")
         os.environ.pop("WORKOS_CLIENT_ID")
 
+    def test_initialize_api_keys(self, default_client):
+        assert bool(default_client.api_keys)
+
     def test_initialize_directory_sync(self, default_client):
         assert bool(default_client.directory_sync)
 

tests/utils/fixtures/mock_api_key.py

@@ -0,0 +1,16 @@
+import datetime
+
+from workos.types.api_keys import ApiKey
+
+
+class MockApiKey(ApiKey):
+    def __init__(self, id="api_key_01234567890"):
+        now = datetime.datetime.now().isoformat()
+        super().__init__(
+            object="api_key",
+            id=id,
+            name="Development API Key",
+            last_used_at=now,
+            created_at=now,
+            updated_at=now,
+        )

workos/_base_client.py

@@ -6,6 +6,7 @@
 from workos.fga import FGAModule
 from workos.utils._base_http_client import DEFAULT_REQUEST_TIMEOUT
 from workos.utils.http_client import HTTPClient
+from workos.api_key import ApiKeyModule
 from workos.audit_logs import AuditLogsModule
 from workos.directory_sync import DirectorySyncModule
 from workos.events import EventsModule
@@ -65,6 +66,10 @@ def __init__(
             else int(os.getenv("WORKOS_REQUEST_TIMEOUT", DEFAULT_REQUEST_TIMEOUT))
         )
 
+    @property
+    @abstractmethod
+    def api_keys(self) -> ApiKeyModule: ...
+
     @property
     @abstractmethod
     def audit_logs(self) -> AuditLogsModule: ...

workos/api_key.py

@@ -0,0 +1,54 @@
+from typing import Protocol
+
+from workos.types.api_keys import ApiKey
+from workos.typing.sync_or_async import SyncOrAsync
+from workos.utils.http_client import AsyncHTTPClient, SyncHTTPClient
+from workos.utils.request_helper import REQUEST_METHOD_POST
+
+
+class ApiKeyModule(Protocol):
+    def validate_api_key(self) -> SyncOrAsync[ApiKey]:
+        """Validates the configured API key.
+
+        Returns:
+            ApiKey: The validated API key details containing
+                information about the key's name and usage
+
+        Raises:
+            AuthenticationException: If the API key is invalid or
+                unauthorized (401)
+            NotFoundException: If the API key is not found (404)
+            ServerException: If the API server encounters an error
+                (5xx)
+        """
+        ...
+
+
+class ApiKey(ApiKeyModule):
+    _http_client: SyncHTTPClient
+
+    def __init__(self, http_client: SyncHTTPClient):
+        self._http_client = http_client
+
+    def validate_api_key(self) -> ApiKey:
+        response = self._http_client.request(
+            "api_keys/validate",
+            method=REQUEST_METHOD_POST,
+        )
+
+        return ApiKey.model_validate(response)
+
+
+class AsyncApiKey(ApiKeyModule):
+    _http_client: AsyncHTTPClient
+
+    def __init__(self, http_client: AsyncHTTPClient):
+        self._http_client = http_client
+
+    async def validate_api_key(self) -> ApiKey:
+        response = await self._http_client.request(
+            "api_keys/validate",
+            method=REQUEST_METHOD_POST,
+        )
+
+        return ApiKey.model_validate(response)

workos/async_client.py

@@ -1,6 +1,7 @@
 from typing import Optional
 from workos.__about__ import __version__
 from workos._base_client import BaseClient
+from workos.api_key import AsyncApiKey
 from workos.audit_logs import AuditLogsModule
 from workos.directory_sync import AsyncDirectorySync
 from workos.events import AsyncEvents
@@ -45,6 +46,12 @@ def __init__(
             timeout=self.request_timeout,
         )
 
+    @property
+    def api_keys(self) -> AsyncApiKey:
+        if not getattr(self, "_api_keys", None):
+            self._api_keys = AsyncApiKey(self._http_client)
+        return self._api_keys
+
     @property
     def sso(self) -> AsyncSSO:
         if not getattr(self, "_sso", None):

workos/client.py

@@ -1,6 +1,7 @@
 from typing import Optional
 from workos.__about__ import __version__
 from workos._base_client import BaseClient
+from workos.api_key import ApiKey
 from workos.audit_logs import AuditLogs
 from workos.directory_sync import DirectorySync
 from workos.fga import FGA
@@ -45,6 +46,12 @@ def __init__(
             timeout=self.request_timeout,
         )
 
+    @property
+    def api_keys(self) -> ApiKey:
+        if not getattr(self, "_api_keys", None):
+            self._api_keys = ApiKey(self._http_client)
+        return self._api_keys
+
     @property
     def sso(self) -> SSO:
         if not getattr(self, "_sso", None):

workos/types/api_key/__init__.py

@@ -0,0 +1 @@
+from .api_key import ApiKey as ApiKey  # noqa: F401

workos/types/api_key/api_key.py

@@ -0,0 +1,12 @@
+from typing import Literal
+
+from workos.types.workos_model import WorkOSModel
+
+
+class ApiKey(WorkOSModel):
+    object: Literal["api_key"]
+    id: str
+    name: str
+    last_used_at: str | None = None
+    created_at: str
+    updated_at: str