grocy/middleware/DefaultAuthMiddleware.php

<?php

namespace Grocy\Middleware;

use Psr\Http\Message\ServerRequestInterface as Request;

class DefaultAuthMiddleware extends AuthMiddleware
{
    protected function authenticate(Request $request)
    {
        // First try to authenticate by API key
        $auth = new ApiKeyAuthMiddleware($this->AppContainer, $this->ResponseFactory);
        $user = $auth->authenticate($request);
        if ($user !== null)
        {
            return $user;
        }

        // Then by session cookie
        $auth = new SessionAuthMiddleware($this->AppContainer, $this->ResponseFactory);
        $user = $auth->authenticate($request);
        return $user;
    }
}