Restful Authentication

# API Key authentication
@app.before_request
def authenticate_api_key():
    if request.path.startswith('/public/'):
        return  # Public endpoints

    api_key = request.headers.get('X-API-Key')
    if not api_key:
        return jsonify({"error": "API key required"}), 401

    key_data = db.verify_api_key(api_key)
    if not key_data:
        return jsonify({"error": "Invalid API key"}), 401

    request.client = key_data.client

# JWT authentication
import jwt

@app.before_request
def authenticate_jwt():
    if request.path.startswith('/auth/'):
        return

    auth_header = request.headers.get('Authorization', '')
    if not auth_header.startswith('Bearer '):
        return jsonify({"error": "Bearer token required"}), 401

    token = auth_header[7:]
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
        request.user_id = payload['user_id']
        request.token_scopes = payload.get('scopes', [])
    except jwt.ExpiredSignatureError:
        return jsonify({"error": "Token expired"}), 401
    except jwt.InvalidTokenError:
        return jsonify({"error": "Invalid token"}), 401

# OAuth 2.0 token endpoint
@app.route('/oauth/token', methods=['POST'])
def issue_token():
    grant_type = request.form.get('grant_type')

    if grant_type == 'client_credentials':
        client = authenticate_client(request)
        token = create_access_token(client_id=client.id, scopes=client.scopes)
        return jsonify({
            "access_token": token,
            "token_type": "Bearer",
            "expires_in": 3600,
            "scope": " ".join(client.scopes)
        })

// JWT middleware
const jwt = require('jsonwebtoken');

function authenticate(req, res, next) {
  const auth = req.headers.authorization;

  if (!auth || !auth.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Authentication required' });
  }

  try {
    const token = auth.split(' ')[1];
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
}

app.get('/api/users/me', authenticate, (req, res) => {
  const user = db.findUser(req.user.id);
  res.json(user);
});