📄 中文摘要
在许多认证教程中，通常需要选择使用 JWT 令牌或 API 密钥。面向用户的 Web 应用通常倾向于使用 JWT，而机器对机器的集成则更喜欢使用长期有效的 API 密钥。当产品同时服务于人类用户和开发者时，必须同时支持这两种认证方式。该项目在单一认证流程中实现了这两者的支持，通过判断令牌是否以 'sk-' 开头来区分：如果是，则为 API 密钥；否则为 JWT。下游的所有处理，如速率限制、工具权限和用户查找，都是相同的。
JWT 与 API 密钥的结合：在 Go 中构建双重认证而不犯常见错误
📄 English Summary
#5 - JWT Meets API Keys: Building Dual-Auth in Go Without the Usual Mistakes
Most authentication tutorials require a choice between JWT tokens and API keys. User-facing web applications typically prefer JWTs, while machine-to-machine integrations favor long-lived API keys. For products serving both human users and developers, supporting both authentication methods is essential. This project implements both in a single authentication pipeline, distinguishing between them by checking if the token starts with 'sk-': if it does, it's an API key; otherwise, it's a JWT. All downstream processes, such as rate limiting, tool permissions, and user lookups, remain identical.