API Key Management

[codebestia]

Background

Merchants need to generate API keys to authenticate server-to-server integrations. Keys must be shown only once at generation time and stored only as a hash.

Proposed Steps

1. Create POST /merchants/api-keys (protected) — generate a key in format sk_live_<32-char-random>, store prefix and sha256(key) hash, return the raw key once only
2. Create GET /merchants/api-keys (protected) — list all non-revoked keys with prefix, label, lastUsedAt, createdAt
3. Create DELETE /merchants/api-keys/:id (protected) — revoke a key by setting revokedAt = now
4. Create an apiKeyAuth middleware that hashes the incoming bearer token, looks it up in ApiKey, updates lastUsedAt, and attaches the merchant to req.merchant
5. Support both JWT and API key authentication transparently in auth.middleware.ts

Acceptance Criteria

• POST /merchants/api-keys returns { key, prefix, id, label, createdAt } — raw key only in this response
• Raw key is not stored in DB; only the SHA-256 hash is persisted
• GET /merchants/api-keys returns list without exposing hashes or raw keys
• DELETE /merchants/api-keys/:id marks key as revoked; subsequent auth attempts return 401
• A merchant can only see and revoke their own keys
• API key auth middleware works alongside JWT middleware
• lastUsedAt is updated on each successful API key authentication
• Maximum of 10 active API keys per merchant (return 400 if limit exceeded)

[Elizabeth-dev270]

I enjoy solving software problems and have experience in backend development, APIs, OOP, and scalable application design.

[Amarjeet325]

Hi, maintainers 👋.
I’d like to work on this issue.
I’m a full-stack developer and smart contract; I have previously contributed to multiple open-source projects.

Could you please assign this issue to me?

[jaynomyaro]

Hi! I’m a full-stack developer with a strong blockchain background. I’d love to handle this issue and can deliver a clean, reliable solution. Kindly assign it to me.

[Menjay7]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. Thank you!

[leocagli]

I'd like to work on this issue, please assign me so I can begin implementation.

[stiven-skyward]

Hi! As a Cloud Engineer and AI Architect, I have extensive experience building secure backend services and robust authentication layers. I'm very comfortable implementing API Key Management systems that prioritize security and scalability. I can have a clean, well-tested PR ready within 24 hours. Best, Stiven.

[grantfox-oss]

🦊 GrantFox — @stiven-skyward has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #14)
2. Your PR will be reviewed by the ShadeProtocol maintainers

Good luck! Track your progress on GrantFox.