@brozeph Thanks for submitting this. I have a question on this: I've been testing a create where I post a new user and include the apikey in the body. I've been finding that since passport-localapikey looks in the body first, it always uses the new apikey (which isn't a valid user yet). In my tests, I had to put the `lookup(req.body, this._apiKeyField)` at the end, checking the `req.query` and `req.headers` first. Maybe a bug in my implementation, but wondering if you've run into the same issue.