create_api_key_endpoint

Overview ¶

Package create_api_key_endpoint registers a public key for the signed-in account.

The account presents a public key and a name for it, and nothing else: no proof that it holds the private half, as no service taking an SSH key asks for one either. Such a proof stops only a key being registered by somebody who talked the account into pasting theirs -- an attacker holding the session registers a key of their own and proves it perfectly well -- while costing every honest registration a trip through a terminal.