From 5b109f2f8ddff2fbcda1aea0d05c5aafca2cd51b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matej=20Ba=C4=8Do?= <matejbaco2000@gmail.com>
Date: Thu, 14 May 2026 19:52:14 +0200
Subject: [PATCH] Fix org key usecase

---
 app/init/resources/request.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/init/resources/request.php b/app/init/resources/request.php
index 2854cb2401..17af87affb 100644
--- a/app/init/resources/request.php
+++ b/app/init/resources/request.php
@@ -1170,6 +1170,11 @@ return function (Container $context): void {
             }
         }
 
+        // API key auth bypasses membership check; key validity is verified later
+        if (!empty($request->getHeader('x-appwrite-key', ''))) {
+            return $team;
+        }
+
         // Unauthorized, do not allow the team
         return new Document([]);
     }, ['project', 'dbForPlatform', 'utopia', 'request', 'authorization', 'user']);