Repository navigation
API keys never expire #499
Description
Background
The ApiKey model is:
model ApiKey {
id String @id @default(uuid())
hash String @unique
label String
ratePerMin Int @default(60)
ratePerDay Int @default(10000)
revokedAt DateTime? @map("revoked_at")
createdAt DateTime @default(now())
...
}There is no expiresAt. A key works forever unless somebody remembers to
revoke it, and lookupApiKey only ever checks revokedAt. A key pasted into a
notebook three years ago is still a valid credential today.
What to build
- An optional
expiresAton the model, set at creation and enforced in
lookupApiKeyalongside therevokedAtcheck. - An expired key must be rejected the same way a revoked one is, and the
rejection should say which — "expired" is actionable, "invalid" is not. - Decide whether new keys get a default lifetime. A default that expires is
safer; a default that does not is friendlier. Pick one, say why, and make it
configurable. - Existing keys must keep working: a null
expiresAtmeans no expiry.
Acceptance criteria
-
expiresAtexists, is optional, and is enforced on lookup - An expired key is rejected with a distinguishable reason
- Existing keys with no expiry are unaffected
- The default lifetime is a documented, configurable decision
- Tests cover an expired key, a null expiry, and a future expiry
Drips Wave · Complexity: Intermediate · 150 points
Repo: Divinity-Labs/Lens. Auth is src/api/auth.ts, key minting
src/api/admin.ts, usage reporting src/api/usage.ts, metering
src/x402/metering.ts, the ApiKey model in prisma/schema.prisma.
Run the tests: npm test. The tests are vitest, not jest. A single file
is npx vitest run src/__tests__/auth.test.ts.
Load test (prices) is already failing on main. Not your PR.
Do not weaken what is already right. Three things are correct today and
should survive every change here:
generateApiKey()islens_plusrandomBytes(24)— 192 bits. Do not
shorten it, and do not make it guessable or sequential.hashApiKey()is an unsalted SHA-256. That is correct for a
high-entropy random key: it must stay fast and deterministic so a lookup is
one indexed query. Do not "improve" it into bcrypt or argon2 — those are for
low-entropy human passwords, and here they would only make every request slow.- Only the hash is ever stored. The plaintext is returned once, at creation,
and never again.
Admin routes carry config: { public: true }. That does not mean public —
it means "skip the API-key hook", because they enforce ADMIN_TOKEN instead.
Removing that flag locks the admin surface behind the keys it exists to mint.
Never elide an address, a key or a token in code, comments, tests or
documentation. Write it in full or not at all — and never write a real key
anywhere.
Required: Before submitting, join the contributor Telegram so your work can be tracked and counted toward the Stellar Wave: https://t.me/+fxHXq8f1SwlkZDBk
Activity
pimaster900 commentedon Oct 18, 2026
@pimaster900 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @pimaster900 to this issue.
Miracle656 commentedon Oct 18, 2026
⏸️ Not funded in the current Wave — please do not start yet
This issue is real and the work is wanted, but it is not currently part of the Drips Wave programme, so a PR against it right now would earn no points. I would rather say that plainly up front than have anyone find out after writing the code.
The repo's Wave budget for this round is exhausted — 25,000 points across 271 labelled issues — and this batch was published just after it ran out. That is my error in pacing, not a reflection on the issue.
What happens next: it will be added to the Wave when the next round opens, at the points value in its label. The description, the acceptance criteria and the code references all stay as they are, so nothing here is wasted.
If you want something to work on today, pick an issue that is already in the Wave — the
Stellar Wavelabel plus an unassigned state is the signal, and Drips will let you apply for it. If Drips will not let you apply for an issue, that is the budget, not you.If you have already started on this one, say so here and I will make sure you are first in line for it when the next round opens.
Oluwato2004 commentedon Oct 18, 2026
@Oluwato2004 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Oluwato2004 to this issue.
mysterio123865 commentedon Oct 18, 2026
@mysterio123865 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @mysterio123865 to this issue.
drips-wave commentedon Oct 18, 2026
Congratulations, @mysterio123865! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @mysterio123865: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊