deternitydx
commented
5 years ago We will need a front-end for managing (Create, revoke). Maybe extend, so that a key will be active longer. First thought: 1 year lifetime.
- To generate: hash of user email and time stamp requested.
- Store them in a table with userid and expiration date.
- provide more feedback about expiration through the rest api when querying with api key
- strip user from the rest reply when using the api key to avoid possible data leaks
Currently, in order for a user to to retrieve their API key, they need to manually log in to SNAC and copy out their temporary key. This is sufficient for manual API work, but prevents automated processes from interacting with SNAC via the API, as there is no way for an external service to automatically log in and/or provide a persistent key.
It would be useful to have either persistent API keys, or some way to log in and retrieve one's own API key, which would not require a manual login. This would allow for e.g. automated services to interact with SNAC without first requiring a manual login.