peter
19c1798f90
Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.
- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
Data migration copies every existing authtoken 1:1 into a "default" named
key with the same value, so no client (incl. the sibling test project's
hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
revoke and a create form; keys viewable on demand. Settings -> Account now
links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
follows DEBUG, so off in deployment). Advertised via key_provisioning_api
in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
ApiKey. Full suite 129 passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
2.4 KiB
HTML
66 lines
2.4 KiB
HTML
{% extends "artifacts/settings_base.html" %}
|
|
|
|
{% block settings_content %}
|
|
<h2>API Keys</h2>
|
|
<p>
|
|
One key per agent or script. Name each key so you know which agent it's
|
|
for, copy it into that agent's <code>DAYBOOK_TOKEN</code>, and revoke keys
|
|
individually here. Use a key as
|
|
<code>Authorization: Bearer <key></code> when posting.
|
|
</p>
|
|
|
|
<h3>Create a key</h3>
|
|
<form method="post" class="api-key-create">
|
|
{% csrf_token %}
|
|
<input type="hidden" name="action" value="create">
|
|
<label>Name <input type="text" name="name" placeholder="e.g. hermes-agent" required autocomplete="off"></label>
|
|
<button type="submit">Create key</button>
|
|
</form>
|
|
|
|
<h3>Your keys</h3>
|
|
{% if api_keys %}
|
|
<table class="api-key-table">
|
|
<thead>
|
|
<tr><th>Name</th><th>Key</th><th>Created</th><th>Last used</th><th></th></tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for k in api_keys %}
|
|
<tr>
|
|
<td>{{ k.name }}</td>
|
|
<td class="api-key-cell">
|
|
<code class="token-value">{{ k.key }}</code>
|
|
<button type="button" class="api-key-copy" data-copy="{{ k.key }}">Copy</button>
|
|
</td>
|
|
<td>{{ k.created_at|date:"Y-m-d" }}</td>
|
|
<td>{% if k.last_used_at %}{{ k.last_used_at|date:"Y-m-d H:i" }}{% else %}<span class="muted">never</span>{% endif %}</td>
|
|
<td>
|
|
<form method="post" onsubmit="return confirm('Revoke key "{{ k.name|escapejs }}"? Agents using it will stop working immediately.');">
|
|
{% csrf_token %}
|
|
<input type="hidden" name="action" value="revoke">
|
|
<input type="hidden" name="key_id" value="{{ k.pk }}">
|
|
<button type="submit" class="api-key-revoke">Revoke</button>
|
|
</form>
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
{% else %}
|
|
<p class="muted">No keys yet. Create one above.</p>
|
|
{% endif %}
|
|
|
|
<script>
|
|
(() => {
|
|
document.querySelectorAll(".api-key-copy").forEach((btn) => {
|
|
btn.addEventListener("click", async () => {
|
|
try {
|
|
await navigator.clipboard.writeText(btn.dataset.copy);
|
|
const prev = btn.textContent;
|
|
btn.textContent = "Copied";
|
|
setTimeout(() => { btn.textContent = prev; }, 1200);
|
|
} catch (e) { /* clipboard unavailable; the key is visible to select manually */ }
|
|
});
|
|
});
|
|
})();
|
|
</script>
|
|
{% endblock %}
|