Struct AdminApiKey 

pub struct AdminApiKey { /* private fields */ }

Admin API key for JWT-based authentication.

Ghost Admin API keys have the format {id}:{hex_secret} where:

• id is the key identifier placed in the JWT kid header
• hex_secret is a hex-encoded byte string used as the HMAC-SHA256 signing key

Security

Admin API keys grant write access to your Ghost installation. Never expose them in client-side code or public repositories.

Example

use ghost_io_api::auth::admin::AdminApiKey;

let raw = "6748592f4b9b7700010f6564:b1b5b9c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1";
let key = AdminApiKey::new(raw).unwrap();
assert_eq!(key.key_id(), "6748592f4b9b7700010f6564");

Implementations

impl AdminApiKey

pub fn new(key: impl Into<String>) -> Result<Self>

Creates a new Admin API key from the Ghost {id}:{hex_secret} format.

Validation

• Must contain exactly one : separator
• id must be non-empty
• hex_secret must be non-empty, contain only hex digits, and have an even length

Errors

Returns GhostError::Auth if the key is malformed.

Example

use ghost_io_api::auth::admin::AdminApiKey;

let key = AdminApiKey::new(
    "6748592f4b9b7700010f6564:b1b5b9c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1"
).unwrap();
assert!(key.is_valid());

// Missing separator
assert!(AdminApiKey::new("noseparator").is_err());

// Non-hex secret
assert!(AdminApiKey::new("kid:xyz").is_err());

pub fn key_id(&self) -> &str

Returns the key ID used as the JWT kid header value.

pub fn is_valid(&self) -> bool

Returns true if the key is structurally valid.

Keys constructed via AdminApiKey::new always pass this check.

pub fn generate_jwt(&self) -> Result<String>

Generates a signed HS256 JWT for use with the Ghost Admin API.

The token includes:

• Header: {"alg":"HS256","kid":"<id>","typ":"JWT"}
• Payload: {"exp":<now+300>,"iat":<now>}
• Signature: HMAC-SHA256 over <header_b64>.<payload_b64>, keyed with the hex-decoded secret

Errors

Returns GhostError::Auth if the system clock is before the Unix epoch or if the secret bytes are rejected by the HMAC implementation.

Example

use ghost_io_api::auth::admin::AdminApiKey;

let key = AdminApiKey::new(
    "6748592f4b9b7700010f6564:b1b5b9c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1"
).unwrap();
let token = key.generate_jwt().unwrap();

// JWT has three dot-separated parts
assert_eq!(token.split('.').count(), 3);

Trait Implementations

impl AsRef<str> for AdminApiKey

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for AdminApiKey

fn clone(&self) -> AdminApiKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdminApiKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AdminApiKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the key for display, masking the secret entirely.

Example

use ghost_io_api::auth::admin::AdminApiKey;

let key = AdminApiKey::new(
    "6748592f4b9b7700010f6564:b1b5b9c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1"
).unwrap();
let display = format!("{key}");
assert!(display.contains("6748592f4b9b7700010f6564"));
assert!(!display.contains("b1b5b9c1"));

impl Eq for AdminApiKey

impl PartialEq for AdminApiKey

fn eq(&self, other: &AdminApiKey) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AdminApiKey