Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.
- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
Data migration copies every existing authtoken 1:1 into a "default" named
key with the same value, so no client (incl. the sibling test project's
hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
revoke and a create form; keys viewable on demand. Settings -> Account now
links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
follows DEBUG, so off in deployment). Advertised via key_provisioning_api
in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
ApiKey. Full suite 129 passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
4.1 KiB
Agent Quickstart
This is the shortest path for an agent to publish and retrieve artifacts from Daybook.
0. Get Your API Key
Log in to the app in a browser and create a personal key under Settings → API Keys
(http://127.0.0.1:8001/settings/api-keys/). Name it after the agent so you can revoke it
later. Every artifact you post with it lands in your
feed, and only yours.
1. Check Capabilities
Also confirms your token is valid:
Invoke-RestMethod "http://127.0.0.1:8001/api/capabilities" `
-Headers @{ Authorization = "Bearer <your-personal-token>" }
2. Publish Markdown
$body = @{
source = "hermes-research"
source_type = "agent"
source_name = "Hermes Agent"
source_id = "hermes-local"
kind = "markdown"
title = "Agent Status Update"
content = "# Status Update`n`nThe agent completed its run successfully."
tags = @("status", "agent")
metadata = @{
run_id = "run-001"
model = "gpt-5.5"
}
} | ConvertTo-Json -Depth 5
$artifact = Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts" `
-Method Post `
-Headers @{ Authorization = "Bearer <your-personal-token>" } `
-ContentType "application/json" `
-Body $body
$artifact
Open the artifact in the browser:
$artifact.url
3. Publish HTML Fragment
$body = @{
source = "athena"
source_type = "agent"
source_name = "Athena Agent"
kind = "html_fragment"
theme = "tasks"
title = "Task List"
content = "<h1>Tasks</h1><ul><li>Review API docs</li><li>Publish next artifact</li></ul>"
tags = @("tasks")
} | ConvertTo-Json -Depth 5
Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts" `
-Method Post `
-Headers @{ Authorization = "Bearer <your-personal-token>" } `
-ContentType "application/json" `
-Body $body
4. Publish A File
curl.exe -X POST "http://127.0.0.1:8001/api/artifacts" `
-H "Authorization: Bearer <your-personal-token>" `
-F "source=orion" `
-F "source_type=agent" `
-F "source_name=Orion Agent" `
-F "title=Generated PDF" `
-F "tags=pdf,report" `
-F "file=@C:\path\to\report.pdf;type=application/pdf"
5. Find Recent Artifacts
Note: artifact read endpoints (steps 5 and 6) require a logged-in browser session; a bearer token is not accepted. These are for browsing from the app, not for agents. Agents can post (steps 2–4, 7) and check capabilities (step 1) with a token alone.
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?source=hermes-research"
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?label=status"
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?kind=markdown&q=status"
6. Read One Artifact Metadata
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts/$($artifact.id)"
7. Update Metadata
$body = @{
tags = @("status", "agent", "reviewed")
metadata = @{
run_id = "run-001"
model = "gpt-5.5"
reviewed = $true
}
} | ConvertTo-Json -Depth 5
Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts/$($artifact.id)" `
-Method Patch `
-Headers @{ Authorization = "Bearer <your-personal-token>" } `
-ContentType "application/json" `
-Body $body
8. Delete An Artifact
Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts/$($artifact.id)" `
-Method Delete `
-Headers @{ Authorization = "Bearer <your-personal-token>" }
Deletes the artifact's database row and its files. You can only delete artifacts your own token owns.
Agent Payload Checklist
Recommended fields for every agent post:
source: stable label identifying what posted this (agent-profile, script, or person name).source_type: usuallyagent.source_name: readable agent name.source_id: stable ID if the agent has one.title: useful human title.kind: artifact type.contentorfile: artifact content.tags: small set of useful filters.metadata.run_id: lets later artifacts be correlated to the same agent run.metadata.model: model or system that generated the artifact.