Skip to content

Add API key expiration and rotation mechanism #49

Closed
Closed
Add API key expiration and rotation mechanism#49
Assignees
jsam
Labels
P2Follow-on functionality after core release prerequisitesbackendBackend/server relatedenhancementNew feature or requestsecuritySecurity related
Milestone
Ops & resources

Description

@jsam
jsam
opened on Mar 17, 2026

Problem

API keys are permanent until manually revoked. There is no expiration, rotation workflow, or key lifecycle management.

Action

  • Add optional TTL/expiration to API keys
  • Implement key rotation workflow (create new key, grace period, revoke old)
  • Add last_used_at tracking for keys to identify stale credentials
  • Consider scoped API keys (read-only, specific KGs only)

Generated from production readiness audit

Activity

  1. jsam
    self-assigned this
    on Mar 17, 2026
  2. jsam
    added
    enhancementNew feature or request
    backendBackend/server related
    securitySecurity related
    on Mar 17, 2026

  3. jsam commented on Oct 1, 2026

    @jsam
    jsam
    on Oct 1, 2026
    ContributorAuthor

    Keys are (label, hash, owner) with create, list and revoke only. Scope:

    • Optional TTL on .apikey create, enforced in authenticate_api_key.
    • created_at and throttled last_used_at shown in .apikey list.
      Scoped keys and revocation that ends live sessions are tracked separately.
  4. jsam
    added this to the Ops & resources milestone on Oct 3, 2026
  5. jsam
    added
    P2Follow-on functionality after core release prerequisites
    on Oct 3, 2026
  6. jsam
    added a commit that references this issue on Oct 3, 2026

    feat(auth): API key expiry, rotation grace period and last-used tracking

    fd416fa
  7. jsam
    closed this as completedin 9ed61b4on Oct 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

P2Follow-on functionality after core release prerequisitesbackendBackend/server relatedenhancementNew feature or requestsecuritySecurity related

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions