This seems kind of awkward. What about a custom Action filter like "AuthorizeWithApiKey" that does the ApiKey-based authentication and sets HttpContext.User, and maybe puts the User object in the RouteData to avoid double-database-lookup?