feat(platform): API keys for programmatic access#485
Merged
Conversation
P2 roadmap item — API-first platform access. Bearer pgerd_* keys accepted by get_current_user alongside OIDC (non-invasive branch). Secrets never stored: SHA-256 hash only, plaintext returned exactly once at creation, key_prefix for recognition, revocation is an auditable timestamp (idempotent). /api/api-keys: POST create, GET list (metadata only), DELETE revoke (uniform 404 for other users' keys). Also carries the 0003_revoked_token down_revision fix ('0002' -> '0002_auth_share') without which alembic upgrade head breaks on a fresh DB. Migration 0007 verified against real Postgres. +5 tests; backend suite 236; mypy clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #467 (needs the 0004→0006 alembic chain; auto-retargets to main when #467 merges — approved pattern).
Why this matters for platform value
Everything so far requires a session cookie — even the CI drift gate. API keys unlock programmatic access: CI/CD integrations, SDKs, external ecosystem. API-first is table stakes for a platform valuation.
Design (security-first)
Authorization: Bearer pgerd_…accepted byget_current_useralongside OIDC — one added branch, OIDC path untouched.key_prefixfor recognition; any lookup failure = the same 401 (no key probing).Also fixes a latent main bug
0003_revoked_tokenhaddown_revision="0002"(nonexistent — actual id0002_auth_share), which breaksalembic upgrade headon any fresh database. Fix carried here (and pushed to #467).Verification
Migration
0007_api_keyapplied against real Postgres; backendpytest236 passed (+5: hash properties, secret-once, revoked/unknown-key 401s, IDOR revoke, metadata-only list); mypy clean.🤖 Generated with Claude Code