Feature: Add API Key Authentication Scoped by User and Tenant #21

New issue

Closed

opened 2026-07-04 21:54:33 +00:00 by psycodepath · 0 comments

psycodepath commented

2026-07-04 21:54:33 +00:00

Owner

Motivation

To secure the REST API for programmatic access, we need a way for clients to authenticate using an API Key scoped to a specific user and tenant, rather than relying on session cookies.

Description

Implement database changes to store API keys (hashed), along with a middleware or resolver that authenticates requests containing an X-API-Key header, validating it against the specific tenant context and resolving the associated user.

User Story

As a developer building a mobile app or home automation script, I want to authenticate my REST API requests using an API Key so that I can query and modify my planner securely without session cookies.

Gherkin Feature

Feature: API Key Authentication
  As an API client
  I want to pass an X-API-Key header
  So that I can authenticate requests for a user under a specific tenant

Acceptance Criteria

Database schema updated to store api keys (hashed, containing id, user_id, tenant_id, key_hash, name, created_at).
Authentication service adapter or middleware supporting X-API-Key header verification.
Scoped validation ensuring the key is only valid for the specific tenant URL it is requested on.
Unit and integration tests verifying successful authentication and rejection of invalid/wrongly scoped keys.

### Motivation To secure the REST API for programmatic access, we need a way for clients to authenticate using an API Key scoped to a specific user and tenant, rather than relying on session cookies. ### Description Implement database changes to store API keys (hashed), along with a middleware or resolver that authenticates requests containing an `X-API-Key` header, validating it against the specific tenant context and resolving the associated user. ### User Story As a developer building a mobile app or home automation script, I want to authenticate my REST API requests using an API Key so that I can query and modify my planner securely without session cookies. ### Gherkin Feature ```gherkin Feature: API Key Authentication As an API client I want to pass an X-API-Key header So that I can authenticate requests for a user under a specific tenant ``` ### Acceptance Criteria - [ ] Database schema updated to store api keys (hashed, containing `id`, `user_id`, `tenant_id`, `key_hash`, `name`, `created_at`). - [ ] Authentication service adapter or middleware supporting `X-API-Key` header verification. - [ ] Scoped validation ensuring the key is only valid for the specific tenant URL it is requested on. - [ ] Unit and integration tests verifying successful authentication and rejection of invalid/wrongly scoped keys.

psycodepath added this to the v1.4.0-rest-api milestone

2026-07-04 21:54:33 +00:00

psycodepath self-assigned this

2026-07-04 21:54:33 +00:00

psycodepath referenced this issue from a pull request that will close it,

2026-07-04 21:55:49 +00:00

feat(security): add API Key authentication scoped by user and tenant #23

psycodepath closed this issue

2026-07-05 19:38:26 +00:00

psycodepath referenced this issue from a commit

2026-07-05 19:38:27 +00:00

feat(security): add API Key authentication scoped by user and tenant (#23)