'Check for permissions by matching the configured API key and header
If settings.DEBUG is True and settings.EDX_API_KEY is not set or None,
then allow the request. Otherwise, allow the request if and only if
settings.EDX_API_KEY is set and the X-Edx-Api-Key HTTP header is
present in the request and matches the setting.'

def has_permission(self, request, view):

    api_key = getattr(settings, 'EDX_API_KEY', None)
    if (settings.DEBUG and (api_key is None)):
        return True
    elif ((api_key is not None) and (request.META.get('HTTP_X_EDX_API_KEY') == api_key)):
        audit_log('ApiKeyHeaderPermission    used', path=request.path, ip=request.META.get('REMOTE_ADDR'))
        return True
    return False
