Issue API keys per tenant with one-time secret reveal #9

New issue

Open

opened 2026-07-01 01:01:00 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:01:00 +00:00

(Migrated from github.com)

Problem

Each tenant needs API keys to call the Introibo API. The admin must mint a key, show the secret exactly once, and persist only a hash.

Acceptance criteria

Creating a key for a tenant returns the plaintext secret exactly once and never again
Only a salted hash of the key is stored in MySQL; the plaintext is never written to disk or logs
Each key records its tenant, label, created-at, and creating operator
A visible key prefix (non-secret) is stored to aid identification in lists

Notes

Clean-room; PHP+MySQL.

## Problem Each tenant needs API keys to call the Introibo API. The admin must mint a key, show the secret exactly once, and persist only a hash. ## Acceptance criteria - [ ] Creating a key for a tenant returns the plaintext secret exactly once and never again - [ ] Only a salted hash of the key is stored in MySQL; the plaintext is never written to disk or logs - [ ] Each key records its tenant, label, created-at, and creating operator - [ ] A visible key prefix (non-secret) is stored to aid identification in lists ## Notes Clean-room; PHP+MySQL.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#9

No description provided.

Rows
Columns