Add API-key authentication middleware for API requests #12

New issue

Open

opened 2026-07-01 01:01:07 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:01:07 +00:00

(Migrated from github.com)

Problem

Incoming API requests must be authenticated by key hash and mapped to a tenant before any quota or business logic runs.

Acceptance criteria

A request presenting a valid, non-revoked key is resolved to its tenant within the request lifecycle
An invalid, revoked, or expired key yields a 401 with a stable, non-leaky error body
Key lookup uses a constant-time hash comparison
The resolved tenant id is made available to downstream quota and logging logic

Notes

This is the Site-side gate; the engine itself stays clean-room.

## Problem Incoming API requests must be authenticated by key hash and mapped to a tenant before any quota or business logic runs. ## Acceptance criteria - [ ] A request presenting a valid, non-revoked key is resolved to its tenant within the request lifecycle - [ ] An invalid, revoked, or expired key yields a 401 with a stable, non-leaky error body - [ ] Key lookup uses a constant-time hash comparison - [ ] The resolved tenant id is made available to downstream quota and logging logic ## Notes This is the Site-side gate; the engine itself stays clean-room.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#12

No description provided.

Rows
Columns