Struct ApiKeyPlugin 

pub struct ApiKeyPlugin { /* private fields */ }

API Key management plugin.

Implementations

impl ApiKeyPlugin

pub async fn create_key( &self, ctx: &AuthContext<impl AuthSchema>, body: &CreateKeyRequest, ) -> AuthResult<CreateKeyResponse>

Create a key on behalf of body.user_id from trusted server code. Organization configurations still require the user’s organization permission.

pub async fn update_key( &self, ctx: &AuthContext<impl AuthSchema>, body: &UpdateKeyRequest, ) -> AuthResult<ApiKeyView>

Update a key on behalf of body.user_id from trusted server code. The caller must authorize access before invoking this server-only method.

impl ApiKeyPlugin

pub async fn verify_api_key( &self, input: &VerifyApiKey<'_>, ctx: &AuthContext<impl AuthSchema>, ) -> Result<ApiKeyView, ApiKeyVerificationError>

Verify a machine credential without a user session or public HTTP endpoint.

A successful verification consumes quota and a rate-limit slot. Permissions and configuration mismatches do not consume usage. The returned key omits the plaintext credential and stored hash.

Without config_id, lookup uses the default configuration’s hashing setting. Validation then uses the configuration that issued the key.

impl ApiKeyPlugin

pub fn configuration(self, config: ApiKeyConfig) -> Self

Register an additional named configuration.

Upstream allows several api-key configurations side by side, each with its own config_id, ownership model and limits.

impl ApiKeyPlugin

Builder for ApiKeyPlugin powered by the bon crate.

Usage:

let plugin = ApiKeyPlugin::builder()
    .key_length(48)
    .prefix("ba_".to_string())
    .enable_metadata(true)
    .rate_limit(RateLimitDefaults { enabled: true, time_window: 60_000.0, max_requests: 5.0 })
    .build();

pub fn with_config(config: ApiKeyConfig) -> Self

pub fn builder() -> ApiKeyPluginBuilder

Trait Implementations

impl<S: AuthSchema> AuthPlugin<S> for ApiKeyPlugin

fn name(&self) -> &'static str

Plugin name - should be unique

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

fn openapi(&self) -> AuthResult<OpenApiPluginMetadata>

Document this configured plugin without invoking application field policies.

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, _ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<BeforeRequestAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for a registered endpoint after HTTP body decoding and origin checks.

fn telemetry_plugin_id(&self) -> Option<&'static str>

Return the upstream plugin ID; core option wrappers have no plugin ID.

fn password_hasher(&self) -> Option<Arc<dyn PasswordHasher>>

Select the base password hasher before plugin initialization wraps it.

fn telemetry(&self, _options: &mut PluginTelemetry)

Report configured options without invoking callbacks or initializing the plugin.

fn rate_limits(&self) -> Result<Vec<PluginRateLimit>, AuthError>

Default endpoint limits, overridden by explicit application limits.

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect an HTTP request after rate limiting and before endpoint middleware. Native API calls do not run this hook. A response skips endpoint hooks.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _response: &'life2 mut AuthResponse, _ctx: &'life3 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Inspect the HTTP router response, including route misses and body errors. Early HTTP request responses and native endpoint calls skip this hook. A replacement response stops the remaining HTTP response hooks.

fn after_request<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _response: &'life2 mut AuthResponse, _ctx: &'life3 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Inspect or extend the final route response after session cookies are applied.

impl Clone for ApiKeyPlugin

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.