It's not like it "could" fail; more like it might accidentally succeed :-).

There are a couple of ways to be more specific here:

 - specifically check for `RAX-KSKEY:apiKeyCredentials` and then `passwordCredentials`, assert only one is present, fail if more than one is, use the one that is.
 - Do this:

   ```python
   auth = content['auth'].copy()
   tenantId = auth.pop("tenantId", None)
   authKey, authValue = auth.popitem()
   if len(auth) != 0:
       raise BadRequest(...)
   ```