Ask HN: How do you handle API-key generation/management for your SaaS?

Posted by runeks on Friday February 19, 2021 @05:21AM
from the ask-hn dept.

I need to implement API-key generation and management for a multi-tenant SaaS.

How have you implemented this for your SaaS?

The API-key system I'm designing needs to support:

* Instant revocation * Different application access levels (e.g. "read-only" and "read+write") * "Read+write" API keys should be able to generate new API keys and revoke old ones (a "read-only" API key must not be able to do this)

Notes:

* I already use Keycloak for user+password logins

( 4 comments | 2 points | on HN )

Re:Ask HN: How do you handle API-key generation/management f... by martinopp on Friday February 19, 2021 @02:55PM (#26197303)

It depends on the tech stack you are currently using for your SaaS. I would not develop this from scratch. For example: If you are using Laravel for the backend, you can develop this feature "easily" using Laravel Passport (https://laravel.com/docs/8.x/passport)

If you are using Keycloak, the solution might be in this post: https://stackoverflow.com/questions/52230634/issuing-api-key...

[ Parent | on HN ]

Re:Ask HN: How do you handle API-key generation/management f... by runeks on Monday February 22, 2021 @07:09AM (#26223577)

Thank you.

I'm super familiar with the backend, but I know it's written in Node.js and that the current authentication solution uses express and passport with a custom table in the Postgres database.

[ Parent | on HN ]

Re:Ask HN: How do you handle API-key generation/management f... by runeks on Tuesday February 23, 2021 @12:34AM (#26234130)

That should have read “I'm not super familiar with the backend”.

[ Parent | on HN ]

Re:Ask HN: How do you handle API-key generation/management f... by sdevonoes on Friday February 19, 2021 @12:05PM (#26195188)

A custom relational table plus custom code.

[ Parent | on HN ]