async def user(self, token: str = Depends(oauth2_scheme)) -> User:
        """Attempt to authenticate via JWT first, then fallback to API key."""
        # Try JWT auth
        try:
            token_data = await self.decode_token(token=token)
            if not token_data.email:
                raise R2RException(
                    status_code=401, message="Could not validate credentials"
                )
            user = (
                await self.database_provider.users_handler.get_user_by_email(
                    email=normalize_email(token_data.email)
                )
            )
            if user is None:
                raise R2RException(
                    status_code=401,
                    message="Invalid authentication credentials",
                )
            return user
        except R2RException:
            # If JWT fails, try API key auth
            # OAuth2PasswordBearer provides token as "Bearer xxx", strip it if needed
            token = token.removeprefix("Bearer ")
            return await self.authenticate_api_key(api_key=token)
Attempt to authenticate via JWT first, then fallback to API key.
py/core/providers/auth/r2r_auth.py