API keys: optional expiry; expired keys get 401 #71

New issue

Open

opened 2026-10-26 10:45:58 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-26 10:45:58 -04:00

Owner

Follow-up to #29 (Phase 13.1, v0.15.1).

#29 asked for an optional expiry per key, and that revoked and expired keys get 401.

Plan

Optional expiresAt at creation (UI date picker + API field), shown on the API Keys page.
Auth rejects expired keys with 401, same as revoked.

Done when

e2e: an expired key gets 401.

Follow-up to #29 (Phase 13.1, v0.15.1). #29 asked for an optional expiry per key, and that revoked **and expired** keys get 401. **Plan** - Optional `expiresAt` at creation (UI date picker + API field), shown on the API Keys page. - Auth rejects expired keys with 401, same as revoked. **Done when** - e2e: an expired key gets 401.

vmanne-poc added this to the Phase 13.1: API key scopes & provider webhooks milestone

2026-10-26 10:45:58 -04:00

vmanne-poc added the

feature

security

labels

2026-10-26 10:45:58 -04:00

vmanne-poc referenced this issue

2026-10-26 10:46:13 -04:00

Project API keys #29