3 ms·

Ask HN: How do you handle API-key generation/management for your SaaS?

2 points by runeks 6y ago

I need to implement API-key generation and management for a multi-tenant SaaS. How have you implemented this for your SaaS? The API-key system I'm designing needs to support: * Instant revocation * Different application access levels (e.g. "read-only" and "read+write") * "Read+write" API keys should be able to generate new API keys and revoke old ones (a "read-only" API key must not be able to do this) Notes: * I already use Keycloak for user+password logins

fetacheese 6y ago
BS
sdevonoes 6y ago
A custom relational table plus custom code.
martinopp 6y ago
It depends on the tech stack you are currently using for your SaaS. I would not develop this from scratch. For example: If you are using Laravel for the backend, you can develop this feature "easily" using Laravel Passport (https://laravel.com/docs/8.x/passport https://laravel.com/docs/8.x/passport) If you are using Keycloak, the solution might be in this post: https://stackoverflow.com/questions/52230634/issuing-api-keys-using-keycloak https://stackoverflow.com/questions/52230634/issuing-api-key...
- runeks 6y ago
  Thank you. I'm super familiar with the backend, but I know it's written in Node.js and that the current authentication solution uses express and passport with a custom table in the Postgres database.
  - runeks 6y ago
    That should have read “I'm not super familiar with the backend”.