Document personal API keys - #10
Merged
Merged
Conversation
- User Guide: listening/api-keys.md (creating a key, the shown-once secret, using it as a Bearer token, last-used, revoking, and that a key inherits the account's permissions) + sidebar entry + a pointer from the account page - Developer Docs: /auth/tokens endpoints in the API reference, the api_keys capability flag, token kinds in auth-and-security, and the cross-repo contract/frontend overview pages
This was referenced Jul 9, 2026
The server bars an API-key caller (403, denyAPIKey) from the four
credential-minting routes (POST /auth/{tokens,recovery,pair,password}),
so a leaked key can't spawn a fresh durable credential. The docs claimed
a key works anywhere a session token does; document the carve-out in the
API reference, conventions, and trust-model pages, and soften the user
guide's can-do-anything wording. Also propagate the new tokens.kind='api'
value to data-model.md and overview.md, which still listed only session
and pairing kinds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Docs for the new user-minted API keys feature (server KodeStar/audiosilo-server#35, frontend KodeStar/audiosilo-frontend#55).
listening/api-keys.md- what a key is, creating one in Settings, the shown-once secret, a curl Bearer example, last-used, revoking, demo-account restriction, and the "a key inherits your permissions - mint from an appropriately-scoped account" advice. Added tosidebars-users.tsplus a pointer from the account page./auth/tokensendpoints in the API reference (shapes, status codes, owner-scoping),api_keysin every capability-flag enumeration, theapitoken kind in auth-and-security (session-or-api bearer resolution, pairing still excluded), and the cross-repo contract / frontend overview pages.All claims verified against the implementation source. No new screenshots (text-only pages).
npm run buildgreen (link/anchor checks pass).Merge order
Merging to main deploys GitHub Pages - land this after the server and frontend PRs so the docs never describe an unreleased surface.