expapikey

Available since Exponential 6.0.15 (in development, not in a release yet).

Summary

A personal API key (publishing key) of a user: one row of expapikey (doc/eng-us/guides/api-keys.md).

Description

A personal API key (publishing key) of a user: one row of expapikey (doc/eng-us/guides/api-keys.md).

A key is the string expk_<id>_<secret>. <id> is twelve random characters [a-z0-9] that identify the key in lists, logs and secret scanners and are stored as they are (key_prefix = "expk_<id>"). <secret> is forty random characters [A-Za-z0-9] (about 238 bits) that are shown to the owner once, when the key is made, and never stored: the row keeps only HMAC-SHA-256( secret, salt ), with a salt of its own per key. A presented key is looked up by its prefix and its secret compared with hash_equals(), so the comparison takes the same time whatever it finds.

A key acts as its owner: the REST layer signs the request in as that user, so the owner's roles and policies still decide what the request may do. On top of that a key carries scopes (rest.ini [ApiKeySettings] Scopes[]), and each scope nee

Persistent

Yes. Table expapikey.

Attributes

* Yes: a field of the table (a stored value); No: a function attribute, computed when it is asked for.

Source

kernel/classes/apikey/expapikey.php, expApiKey::definition()

Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this object.