Issue, rotate, and revoke API keys #23

New issue

Closed

opened 2026-07-01 00:58:08 +00:00 by manlycucumber · 1 comment

manlycucumber commented

2026-07-01 00:58:08 +00:00

(Migrated from github.com)

Problem

Tenants need API keys they can create, rotate, and revoke. Keys must be stored securely and validated on every request without leaking the secret.

Acceptance criteria

An admin flow issues a new key for a tenant and returns the secret once.
Keys can be rotated and revoked; revoked keys are rejected.
Stored keys are hashed, never stored in plaintext.
Issue/rotate/revoke flows are covered by tests.

Notes

Show the raw secret exactly once at creation; persist only a hash.

## Problem Tenants need API keys they can create, rotate, and revoke. Keys must be stored securely and validated on every request without leaking the secret. ## Acceptance criteria - [ ] An admin flow issues a new key for a tenant and returns the secret once. - [ ] Keys can be rotated and revoked; revoked keys are rejected. - [ ] Stored keys are hashed, never stored in plaintext. - [ ] Issue/rotate/revoke flows are covered by tests. ## Notes Show the raw secret exactly once at creation; persist only a hash.

manlycucumber commented

2026-07-03 06:11:00 +00:00

(Migrated from github.com)

Delivered in #137 (squash-merged to develop).

Delivered in #137 (squash-merged to `develop`).

manlycucumber referenced this issue from a commit

2026-08-05 19:02:25 +00:00

feat: API keys, per-tenant quotas, and per-key rate limits (#137)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Api#23

No description provided.

Rows
Columns