diff --git a/pkg/server/api/connect/v1/api_key_middleware.go b/pkg/server/api/connect/v1/api_key_middleware.go
index e0e9fa753..13d683b1f 100644
--- a/pkg/server/api/connect/v1/api_key_middleware.go
+++ b/pkg/server/api/connect/v1/api_key_middleware.go
@@ -42,12 +42,6 @@ func NewAPIKeyMiddleware(svc *iam.Service) func(next http.Handler) http.Handler
 			func(w http.ResponseWriter, r *http.Request) {
 				ctx := r.Context()
 
-				session := SessionFromContext(ctx)
-				if session != nil {
-					httpserver.RenderError(w, http.StatusBadRequest, errors.New("api key authentication cannot be used with session authentication"))
-					return
-				}
-
 				tokenValue, err := securetoken.Get(r, "")
 				if err != nil {
 					next.ServeHTTP(w, r)
@@ -60,6 +54,12 @@ func NewAPIKeyMiddleware(svc *iam.Service) func(next http.Handler) http.Handler
 					return
 				}
 
+				session := SessionFromContext(ctx)
+				if keyID != gid.Nil && session != nil {
+					httpserver.RenderError(w, http.StatusBadRequest, errors.New("api key authentication cannot be used with session authentication"))
+					return
+				}
+
 				apiKey, err := svc.APIKeyService.GetAPIKey(ctx, keyID)
 				if err != nil {
 					var errUserAPIKeyNotFound *iam.ErrUserAPIKeyNotFound
diff --git a/pkg/server/api/connect/v1/session_middleware.go b/pkg/server/api/connect/v1/session_middleware.go
index d47d4213f..acc50d407 100644
--- a/pkg/server/api/connect/v1/session_middleware.go
+++ b/pkg/server/api/connect/v1/session_middleware.go
@@ -49,12 +49,6 @@ func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) fu
 			func(w http.ResponseWriter, r *http.Request) {
 				ctx := r.Context()
 
-				apiKey := APIKeyFromContext(ctx)
-				if apiKey != nil {
-					httpserver.RenderError(w, http.StatusBadRequest, errors.New("session authentication cannot be used with API key authentication"))
-					return
-				}
-
 				cookieValue, err := securecookie.Get(r, cookieConfig)
 				if err != nil {
 					next.ServeHTTP(w, r)
@@ -68,6 +62,12 @@ func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) fu
 					return
 				}
 
+				apiKey := APIKeyFromContext(ctx)
+				if sessionID != gid.Nil && apiKey != nil {
+					httpserver.RenderError(w, http.StatusBadRequest, errors.New("session authentication cannot be used with API key authentication"))
+					return
+				}
+
 				session, err := svc.SessionService.GetSession(ctx, sessionID)
 				if err != nil {
 					var errSessionNotFound *iam.ErrSessionNotFound