Project API keys #29

New issue

Closed

opened 2026-10-15 01:05:08 -04:00 by vmanne-poc · 1 comment

vmanne-poc commented

2026-10-15 01:05:08 -04:00

Owner

Goal: let other systems (a website sign-up flow, a CRM sync, scripts) call the Postak API for one project without using a person's login.

Plan

Keys: per project, created by owners. Each key has a name, optional scopes (for example contacts:write and campaigns:send), an optional expiry, and a last-used time.
Storage: the key is shown once at creation and stored only as a hash (with a short prefix kept for display). A key can be revoked.
Auth: Authorization: Bearer pk_..., accepted on project-scoped routes only. A key can only reach its own project. Account, user and admin routes stay off-limits to keys.
API Keys page in the project.
Rate limiting per key.
Every key use is attributable (key id appears in logs).

Done when

e2e tests show:
- a key can't reach another project or the admin routes
- revoked and expired keys get 401
- scopes are enforced
- the plain key is never returned again after creation

**Goal:** let other systems (a website sign-up flow, a CRM sync, scripts) call the Postak API for one project without using a person's login. **Plan** - **Keys:** per project, created by owners. Each key has a name, optional scopes (for example `contacts:write` and `campaigns:send`), an optional expiry, and a last-used time. - **Storage:** the key is shown once at creation and stored only as a hash (with a short prefix kept for display). A key can be revoked. - **Auth:** `Authorization: Bearer pk_...`, accepted on project-scoped routes only. A key can only reach its own project. Account, user and admin routes stay off-limits to keys. - **API Keys page** in the project. - **Rate limiting** per key. - Every key use is attributable (key id appears in logs). **Done when** - e2e tests show: - a key can't reach another project or the admin routes - revoked and expired keys get 401 - scopes are enforced - the plain key is never returned again after creation

vmanne-poc added this to the Phase 13: A/B testing, API keys, API sending & MJML milestone

2026-10-15 01:05:08 -04:00

vmanne-poc added the

security

feature

labels

2026-10-15 01:05:08 -04:00

vmanne-poc referenced this issue from a commit

2026-10-26 09:13:16 -04:00

feat: project API keys for the public API (Refs #29)

vmanne-poc referenced this issue from a commit

2026-10-26 09:13:16 -04:00

feat: API keys section in project settings (Refs #29)

vmanne-poc referenced this issue from a commit

2026-10-26 09:13:16 -04:00

test: API key prefix-collision retry and winner pick with a key (Refs #29)

vmanne-poc referenced this issue from a pull request that will close it,

2026-10-26 09:14:09 -04:00

Phase 13: A/B testing, API keys, API sending & MJML (v0.15.0) #69

vmanne-poc closed this issue

2026-10-26 09:14:15 -04:00

vmanne-poc referenced this issue

2026-10-26 10:45:56 -04:00

API keys: scopes (contacts:write, campaigns:send) enforced per route #70

vmanne-poc referenced this issue

2026-10-26 10:45:58 -04:00

API keys: optional expiry; expired keys get 401 #71

vmanne-poc referenced this issue

2026-10-26 10:46:00 -04:00

API keys: log key id on every key-authenticated request #72

vmanne-poc referenced this issue

2026-10-26 10:46:07 -04:00

Flaky e2e test: API key rate limiting #74

vmanne-poc referenced this issue

2026-10-26 10:46:09 -04:00

nginx: re-resolve backend upstream after container restart #75

vmanne-poc commented

2026-10-26 10:46:13 -04:00

Author

Owner

Requirements not delivered in v0.15.0 are tracked in Phase 13.1 (v0.15.1): #70 scopes, #71 expiry, #72 per-use key logging, #74 flaky rate-limit e2e test, #75 nginx upstream re-resolution.