Versions in this module Expand all Collapse all v1 v1.3.0 Oct 23, 2026 Changes in this version + const DefaultKeyPrefix + const EntropyBytes + const EventAPIKeyAuthenticated + const EventAPIKeyCreated + const EventAPIKeyDeleted + const EventAPIKeyRevoked + const EventAPIKeyRotated + const ModelAPIKeys + const PluginID + const PublicPrefixLength + var ErrConflict = errors.New("apikeys: API key conflict") + var ErrInsufficientPermission = errors.New("apikeys: insufficient permission") + var ErrInsufficientScope = errors.New("apikeys: insufficient scope") + var ErrInvalidInput = errors.New("apikeys: invalid input") + var ErrInvalidKey = errors.New("apikeys: invalid API key") + var ErrKeyExpired = errors.New("apikeys: API key has expired") + var ErrKeyNotFound = errors.New("apikeys: API key not found") + var ErrKeyRevoked = errors.New("apikeys: API key has been revoked") + var ErrRateLimited = errors.New("apikeys: rate limit exceeded, authentication throttled") + var ErrStoreRequired = errors.New("apikeys: store adapter is required") + func ConstantTimeEqual(a, b string) bool + func DummyHashVerification(rawKey string) bool + func GenerateID(prefix string) string + func GenerateRawKey(prefix string) (rawKey string, publicPrefix string, keyHash string, err error) + func HashKey(rawKey string) string + func RegisterSchema(s *schema.Schema) error + func VerifyKey(rawKey string, expectedHash string) bool + func WithAPIKey(ctx context.Context, key *APIKey) context.Context + type APIKey struct + CreatedAt time.Time + ExpiresAt *time.Time + ID string + KeyHash string + LastUsedAt *time.Time + LastUsedIP string + LastUsedUA string + Metadata map[string]string + Name string + OrganizationID string + Permissions []string + Prefix string + RevokedAt *time.Time + Scopes []string + ServiceID string + UpdatedAt time.Time + UserID string + func APIKeyFrom(ctx context.Context) (*APIKey, bool) + func (k *APIKey) HasAllPermissions(permissions ...string) bool + func (k *APIKey) HasAllScopes(scopes ...string) bool + func (k *APIKey) HasAnyPermission(permissions ...string) bool + func (k *APIKey) HasAnyScope(scopes ...string) bool + func (k *APIKey) HasPermission(permission string) bool + func (k *APIKey) HasScope(scope string) bool + func (k *APIKey) IsActive(now time.Time) bool + func (k *APIKey) IsExpired(now time.Time) bool + func (k *APIKey) IsRevoked() bool + type APIKeys interface + Authenticate func(ctx context.Context, rawKey string, opts ...AuthOption) (*AuthResult, error) + Create func(ctx context.Context, in CreateInput) (*CreateResult, error) + Delete func(ctx context.Context, id string) error + Get func(ctx context.Context, id string) (*APIKey, error) + Hooks func() *Hooks + List func(ctx context.Context, filter ListFilter) ([]*APIKey, error) + PurgeExpired func(ctx context.Context) (int, error) + Revoke func(ctx context.Context, id string) error + Rotate func(ctx context.Context, id string, opts ...RotateOption) (*RotateResult, error) + type AuthOption func(*authConfig) + func WithIPAddress(ip string) AuthOption + func WithRequiredPermissions(perms ...string) AuthOption + func WithRequiredScopes(scopes ...string) AuthOption + func WithUserAgent(ua string) AuthOption + type AuthResult struct + Key *APIKey + Principal auth.Principal + type AuthenticatedPayload struct + ID string + IPAddress string + OrganizationID string + Prefix string + PrincipalType string + ServiceID string + Subject string + UserAgent string + UserID string + type Config struct + BruteForceWindow time.Duration + CacheTTL time.Duration + DefaultExpiresIn time.Duration + KeyPrefix string + MaxFailedAttempts int + SubjectStrategy SubjectStrategy + TouchLastUsedThreshold time.Duration + type CreateInput struct + ExpiresAt *time.Time + ExpiresIn time.Duration + Metadata map[string]string + Name string + OrganizationID string + Permissions []string + Prefix string + Scopes []string + ServiceID string + UserID string + type CreateResult struct + Key *APIKey + RawKey string + type CreatedPayload struct + ExpiresAt *time.Time + ID string + Name string + OrganizationID string + Permissions []string + Prefix string + Scopes []string + ServiceID string + UserID string + type DeletedPayload struct + ID string + OrganizationID string + Prefix string + ServiceID string + UserID string + type Hooks struct + func (h *Hooks) AfterAuthenticate(fn func(ctx context.Context, res *AuthResult)) + func (h *Hooks) AfterCreate(fn func(ctx context.Context, key *APIKey)) + func (h *Hooks) AfterRevoke(fn func(ctx context.Context, key *APIKey)) + func (h *Hooks) AfterRotate(fn func(ctx context.Context, res *RotateResult)) + func (h *Hooks) BeforeAuthenticate(fn func(ctx context.Context, rawKey *string) error) + func (h *Hooks) BeforeCreate(fn func(ctx context.Context, in *CreateInput) error) + func (h *Hooks) BeforeRevoke(fn func(ctx context.Context, keyID *string) error) + func (h *Hooks) BeforeRotate(fn func(ctx context.Context, keyID *string) error) + type ListFilter struct + IncludeRevoked bool + Limit int + Offset int + OrganizationID string + ServiceID string + UserID string + type Module struct + func New(opts ...Option) *Module + func (m *Module) ID() string + func (m *Module) Init(h *auth.Host) error + func (m *Module) RegisterSchema(s *schema.Schema) error + type Option func(*Config) + func WithBruteForceProtection(maxAttempts int, window time.Duration) Option + func WithCacheTTL(d time.Duration) Option + func WithDefaultExpiresIn(d time.Duration) Option + func WithKeyPrefix(p string) Option + func WithSubjectStrategy(s SubjectStrategy) Option + func WithTouchLastUsedThreshold(d time.Duration) Option + type RevokedPayload struct + ID string + OrganizationID string + Prefix string + RevokedAt time.Time + ServiceID string + UserID string + type RotateOption func(*rotateConfig) + func WithGracePeriod(d time.Duration) RotateOption + func WithNewExpiresIn(d time.Duration) RotateOption + func WithNewMetadata(meta map[string]string) RotateOption + func WithNewName(name string) RotateOption + func WithNewPermissions(perms []string) RotateOption + func WithNewScopes(scopes []string) RotateOption + type RotateResult struct + NewKey *APIKey + OldKey *APIKey + RawKey string + type RotatedPayload struct + GracePeriod *time.Time + NewKeyID string + OldKeyID string + OrganizationID string + Prefix string + ServiceID string + UserID string + type SubjectStrategy string + const SubjectStrategyKeyID + const SubjectStrategyOwner
Go to main page