API keys that carry only what you granted
A key is not an account. It carries a named set of permissions and nothing more.
- Pick the exact permissions a key holds when you create it
- The secret is shown once, stored only as a hash, and can be revoked at any time
- Optional expiry date, plus a last-used timestamp so a forgotten key is visible
- Every request a key makes is logged: method, path, status, address