Package com.codename1.backend.security.apikey

package com.codename1.backend.security.apikey

API keys: long-lived secrets a program presents instead of signing in.

A key is generated once and shown once. What is stored is its SHA-256, so a copy of the table is not a set of working keys, and a request is authenticated by hashing what it presents and looking that up.

GeneratedApiKey made = new ApiKeyGenerator().generate("ci-bot", "deploy", "read");
repository.save(made.getApiKey());          // the hash, the owner, the scopes
show(made.getPlaintext());                  // cn1_Zm9v...; never available again

Turned on with http.apiKey(...); see ApiKeyConfigurer.

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.
com.codename1.backend.security.crypto	Password hashing: the PasswordEncoder contract, the delegating encoder that reads the {id} in front of a stored password, and the encoders behind it.
com.codename1.backend.security.mfa	A second factor at sign-in: one-time codes from an authenticator app, and the recovery codes that stand in for a lost phone.
com.codename1.backend.security.ratelimit	Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.
com.codename1.backend.security.rememberme	Remember-me: recognizing a returning user by a cookie, so that closing the browser does not sign them out.
com.codename1.backend.security.webauthn	Passkeys: signing in with a credential an authenticator holds, as the Web Authentication specification defines it.

Class	Description
ApiKey	What a server keeps about an API key: who it acts for, what it may do, whether it has been revoked, and the SHA-256 by which a presented key is recognized.
ApiKeyAuthenticationToken	Who a request is from, when an API key says so.
ApiKeyGenerator	Makes API keys: a prefix, then 32 random bytes as base64url.
ApiKeyRepository	Where API keys are kept.
GeneratedApiKey	A key that has just been made: the one moment its text exists.
InMemoryApiKeyRepository	API keys held in memory: for tests, and for a server whose few keys come from its configuration.
JdbcApiKeyRepository	API keys kept in the server's database, in the cn1_api_key table of SecuritySchema.