Ask HN: How do you handle API-key generation/management for your SaaS?
I need to implement API-key generation and management for a multi-tenant SaaS.
How have you implemented this for your SaaS?
The API-key system I'm designing needs to support:
* Instant revocation
* Different application access levels (e.g. "read-only" and "read+write")
* "Read+write" API keys should be able to generate new API keys and revoke old ones (a "read-only" API key must not be able to do this)
How have you implemented this for your SaaS?
The API-key system I'm designing needs to support:
* Instant revocation * Different application access levels (e.g. "read-only" and "read+write") * "Read+write" API keys should be able to generate new API keys and revoke old ones (a "read-only" API key must not be able to do this)
Notes:
* I already use Keycloak for user+password logins