pub struct ApiKeyConfig {Show 27 fields
pub config_id: String,
pub references: ApiKeyReferences,
pub storage: ApiKeyStorageMode,
pub fallback_to_database: bool,
pub secondary_storage: Option<Arc<dyn CacheAdapter>>,
pub custom_storage: Option<Arc<dyn ApiKeyStorage>>,
pub key_length: f64,
pub prefix: Option<String>,
pub default_permissions: Option<ApiKeyPermissions>,
pub custom_key_generator: Option<Arc<dyn ApiKeyGenerator>>,
pub default_permissions_callback: Option<Arc<dyn ApiKeyDefaultPermissions>>,
pub api_key_headers: Vec<String>,
pub custom_api_key_getter: Option<Arc<dyn ApiKeyGetter>>,
pub custom_api_key_validator: Option<Arc<dyn ApiKeyValidator>>,
pub disable_key_hashing: bool,
pub starting_characters_length: f64,
pub store_starting_characters: bool,
pub max_prefix_length: f64,
pub min_prefix_length: f64,
pub max_name_length: f64,
pub min_name_length: f64,
pub require_name: bool,
pub enable_metadata: bool,
pub key_expiration: KeyExpirationConfig,
pub rate_limit: RateLimitDefaults,
pub enable_session_for_api_keys: bool,
pub defer_updates: bool,
}Expand description
Configuration for the API Key plugin, aligned with the TypeScript ApiKeyOptions.
Fields§
§config_id: StringName of this configuration, stored on every key it creates.
Upstream defaults it to "default".
references: ApiKeyReferencesWhether keys from this configuration belong to a user or to an organization.
storage: ApiKeyStorageModeDatabase persistence (default) or application-owned secondary storage.
fallback_to_database: boolUse database rows for durable writes and admission in secondary mode.
secondary_storage: Option<Arc<dyn CacheAdapter>>Shared secondary cache for this plugin, independent of session persistence.
custom_storage: Option<Arc<dyn ApiKeyStorage>>Application storage overriding the plugin’s secondary cache.
key_length: f64Raw length excluding the prefix. Zero and NaN use 64; the built-in generator admits safely terminating fractions from 0.5 upward. A custom generator receives the number unchanged after that fallback.
prefix: Option<String>§default_permissions: Option<ApiKeyPermissions>Permissions applied when creation does not supply explicit permissions.
custom_key_generator: Option<Arc<dyn ApiKeyGenerator>>Optional application generator, receiving only length and effective prefix.
default_permissions_callback: Option<Arc<dyn ApiKeyDefaultPermissions>>Dynamic defaults replace static default_permissions when configured.
api_key_headers: Vec<String>§custom_api_key_getter: Option<Arc<dyn ApiKeyGetter>>Trusted application lookup, replacing api_key_headers when configured.
custom_api_key_validator: Option<Arc<dyn ApiKeyValidator>>Trusted acceptance predicate, checked before quota and rate-limit writes.
disable_key_hashing: bool§starting_characters_length: f64UTF-16 substring end: finite fractions truncate, negative/NaN select an empty prefix, and positive infinity selects the whole credential. SQLite retains a cut through a surrogate pair as actual WTF-8 TEXT.
store_starting_characters: bool§max_prefix_length: f64Compare the actual UTF-16 prefix length against this raw number.
min_prefix_length: f64Compare the actual UTF-16 prefix length against this raw number.
max_name_length: f64Compare the actual UTF-16 name length against this raw number.
min_name_length: f64Compare the actual UTF-16 name length against this raw number.
require_name: bool§enable_metadata: bool§key_expiration: KeyExpirationConfig§rate_limit: RateLimitDefaults§enable_session_for_api_keys: bool§defer_updates: boolStart secondary-only usage merges and automatic cleanup in background work. The application background handler receives completion observations. Successful trusted verification launches cleanup only when enabled. Database quota and rate-limit admission remain atomic and awaited.