This implementation below enables you to use a decorator without further inheritances.

from odoo import SUPERUSER_ID

from odoo.exceptions import ValidationError as VE

from odoo.http import request, db_list

1. Decorator

def authenticate(func):

    @wraps(func)

    def validate_api_key(*args, **kw):

        auth_error = messages.get('access')

        key = request.httprequest.headers.get('api-key')

        if not key:

            raise VE(auth_error)

        if not request.session.db:

            request.session.db = db_list()[0]  # here we pick the first available db if the instance is a multi db and db_name has not been set in the odoo.conf

        uid = request.env['res.users.apikeys'].with_user(SUPERUSER_ID)._check_credentials(scope='rpc', key=key)

        if not uid:

            logger.error(f"{func.__name__} auth_error['message']")

            raise VE(auth_error)

        request.update_env(user=uid)  # here we switch the user to the one owning this key

        return func(*args, **kw)

    return validate_api_key

2. Controller

    @authenticate

    @route(['/products'], auth="public", type='json', methods=['POST'], csrf=False)

    def create_product(self, **kw):

@Luke, try to change @classmethod by @property, for me it works. Thanks @Michael for sharing.

Sorry again @Luke, but @Michael 's code is right but you have to consider putting it as a model, I was confused, maybe like you, and I wrote it into the controller but that's wrong.