From b0c01622118b360f3a4b63260eccc31d4856b910 Mon Sep 17 00:00:00 2001
From: Steven Nguyen <1477010+stnguyen90@users.noreply.github.com>
Date: Thu, 2 Oct 2025 21:55:25 +0000
Subject: [PATCH] Move disable

---
 app/controllers/shared/api.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index 22dc54d2c9..629b16e9fa 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -215,10 +215,10 @@ App::init()
             $role = $apiKey->getRole();
             $scopes = $apiKey->getScopes();
 
-            // Disable authorization checks for API keys
-            Authorization::setDefaultStatus(false);
-
             if ($apiKey->getRole() === Auth::USER_ROLE_APPS) {
+                // Disable authorization checks for API keys
+                Authorization::setDefaultStatus(false);
+
                 $user = new Document([
                     '$id' => '',
                     'status' => true,
@@ -689,7 +689,7 @@ App::shutdown()
              * A future optimisation is to only trigger webhooks if the webhook is "enabled"
              * But it might have performance implications on the API due to the number of webhooks etc.
              * Some profiling is needed to see if this is a problem.
-            */
+             */
             if (!empty($project->getAttribute('webhooks'))) {
                 $queueForWebhooks
                     ->from($queueForEvents)