Authenticate requests and scope them to a tenant #24

New issue

Closed

opened 2026-07-01 00:58:11 +00:00 by manlycucumber · 1 comment

manlycucumber commented

2026-07-01 00:58:11 +00:00

(Migrated from github.com)

Problem

Every non-public request must present a valid API key, which authenticates the caller and scopes quota/rate-limit accounting to the right tenant.

Acceptance criteria

Requests are authenticated via the API key and resolved to a tenant.
Missing or invalid keys return the canonical 401/403 error shape.
Authentication runs before quota and rate-limit checks.
Auth behavior is covered by tests for valid, missing, and revoked keys.

Notes

Keep auth off the cache-everything path so authenticated responses are not edge-cached incorrectly.

## Problem Every non-public request must present a valid API key, which authenticates the caller and scopes quota/rate-limit accounting to the right tenant. ## Acceptance criteria - [ ] Requests are authenticated via the API key and resolved to a tenant. - [ ] Missing or invalid keys return the canonical 401/403 error shape. - [ ] Authentication runs before quota and rate-limit checks. - [ ] Auth behavior is covered by tests for valid, missing, and revoked keys. ## Notes Keep auth off the cache-everything path so authenticated responses are not edge-cached incorrectly.

manlycucumber commented

2026-07-03 06:11:01 +00:00

(Migrated from github.com)

Delivered in #137 (squash-merged to develop).

Delivered in #137 (squash-merged to `develop`).

manlycucumber referenced this issue from a commit

2026-08-05 19:02:25 +00:00

feat: API keys, per-tenant quotas, and per-key rate limits (#137)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Api#24

No description provided.

Rows
Columns