case let apiKey as APIKey:
  guard let user = try User.query().filter(“username”, apiKey.id).first(),
  try BCrypt.verify(password: apiKey.secret, matchesHash: user.password) else {
    throw Abort.custom(status: .networkAuthenticationRequired, message: “Invalid user name or password.”)
  }