apikeys

Documentation

Overview

Package apikeys handles generating, revoking, and listing data on api keys.

API keys are used for authenticating automated access to this app. In other words, other apps accessing this app's data.

The app can store and use multiple API keys. Idealy one API key is used for each integration to this app. Doing so allows for revoking one API key without affecting other integrations.

Only certain endpoints are accessible via an API key. Not all of this app's data is accessible via an outside integration. This is for security purposes. The list of accessible endpoints is noted below in the publicEndpoints slice.

API keys are stored in plain text on the server. This is done since is someone outside of and approved user of an API key has access to the API key, they can already perform actions of that API key. API keys are not like passwords where they are often reused or provided each time. Furthermore, if someone has access to a list of API keys then they most likely have access to the database anyway. The best use case for a hashed value being stored in the database is that someone browsing the database won't be able to use an API key just by looking at the stored value.

Index

• Variables
• func Generate(w http.ResponseWriter, r *http.Request)
• func GetAll(w http.ResponseWriter, r *http.Request)
• func IsPublicEndpoint(urlPath string) bool
• func KeyLength() int
• func Revoke(w http.ResponseWriter, r *http.Request)

Variables

var ErrNonPublicEndpoint = errors.New("api: access denied to non-public endpoint")

ErrNonPublicEndpoint is returned when a request is made via an API key to an endpoint that isn't in the list publicEndpoints.

Functions

func Generate

func Generate(w http.ResponseWriter, r *http.Request)

Generate creates a new API key and saves it to the database.

func GetAll

func GetAll(w http.ResponseWriter, r *http.Request)

GetAll looks up a list of all API keys.

func IsPublicEndpoint

func IsPublicEndpoint(urlPath string) bool

IsPublicEndpoint checks if a provided URL is in the list of publically accessible endpoints. If not, it returnes an error.

func KeyLength

func KeyLength() int

KeyLength returns the length of API keys generated inclusive of the key prefix. This is used during validation of API requests to simply check if the provided API key is the correct length before looking up the API key in the database.

func Revoke

func Revoke(w http.ResponseWriter, r *http.Request)

Revoke marks an API key as inactive. An inactive API key cannot be reactivated.