Keys

Mint a key

The key field of the answer is the only time the secret is readable, here or anywhere: what is stored is a hash. Store it in the same step that makes it, because a caller that does not has no way back to it and has to make another one.

A key can only make one as narrow as itself, so a render key asking for full is a 403 rather than a quietly narrowed key. Give every system its own, then revoking one upsets nothing else.

Needs a key scoped write or full.

post/api/keys

Request

  • Base URL: https://morfee.furo.solutions
  • URL: https://morfee.furo.solutions/api/keys
  • Auth: one of:
    • API key in header X-Api-Key
    • HTTP bearer

Request body

namestring required

What this key is for.

scope'read' | 'render' | 'write' | 'full'

Never wider than the key asking. A render key cannot mint a full one, otherwise a narrow key would be a full key with one extra call in front of it.

expiresInDaysinteger

Or expiresAt. Leave both out for a key that does not expire.

expiresAtstring date-time

An absolute moment. In the past is a 400: the key would be dead on arrival.

Response

The key, once.

okboolean
keystring

The secret. This is the only answer it ever appears in.

idstring
prefixstring
scope'read' | 'render' | 'write' | 'full'
expiresAtstring date-time nullable
hintstring

Changes

No recorded changes to this operation across all 1 revision of this API.