diff --git a/pkg/server/api/connect/v1/graphql_handler.go b/pkg/server/api/connect/v1/graphql_handler.go
index 0f326456f..860d5bd0f 100644
--- a/pkg/server/api/connect/v1/graphql_handler.go
+++ b/pkg/server/api/connect/v1/graphql_handler.go
@@ -54,15 +54,16 @@ var (
 
 func SessionDirective(ctx context.Context, obj any, next graphql.Resolver, required types.SessionRequirement) (any, error) {
 	session := SessionFromContext(ctx)
+	apiKey := APIKeyFromContext(ctx)
 
 	switch required {
 	case types.SessionRequirementOptional:
 	case types.SessionRequirementPresent:
-		if session == nil {
+		if session == nil && apiKey == nil {
 			return nil, ErrUnauthenticated
 		}
 	case types.SessionRequirementNone:
-		if session != nil {
+		if session != nil && apiKey != nil {
 			return nil, ErrAlreadyAuthenticated
 		}
 	}