Skip to content

Add a list-api-keys CLI command #3

Description

@OliverD25

src/crypto_processing_api/cli.py can mint a key (create-api-key) and revoke
one (revoke-api-key), and there is no way to see what exists. You cannot
revoke what you cannot list
revoke-api-key takes a key_id, and the only
place a key_id was ever shown is the output of create-api-key, months ago,
in a terminal that is gone.

What to build

A list-api-keys subcommand printing one row per key: key_id, name,
scope, created_at, last_used_at, and whether it is revoked or expired.

Constraints

  • Never print the key itself, and never print the hash. The plaintext key
    does not exist anywhere after creation, which is the point; key_hash is not
    secret in theory but is not useful to anyone and belongs nowhere near a
    terminal. key_id is the non-secret lookup handle — see the module docstring
    at the top of src/crypto_processing_api/core/auth.py.
  • Revoked and expired keys should still be listed, marked as such. An operator
    auditing who had access needs the history, not just the live set.
  • Follow the argparse shape the other subcommands use in cli.py around lines
    168-190.

Nice to have

--include-revoked/--only-active and a --json flag, if it stays small.

Where to start

src/crypto_processing_api/cli.py, the ApiKey model at
src/crypto_processing_api/ledger/models.py:460.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions