Skip to main content
Table of Contents

Namespace Stratara.Abstractions.ApiKeys

Classes

ApiKeyDescriptor

The stored, non-secret description of an issued API key. The raw key itself is never persisted — only its hash — so a descriptor can be listed and audited freely.

ApiKeyFormat

The canonical raw-key format shared by every IApiKeyStore implementation: Prefix followed by the Base64Url encoding of 32 CSPRNG bytes. The prefix helps secret scanners flag leaked keys; the fixed length is what lets a store keep its stored digest unsalted.

ApiKeyImportRequest

Parameters for importing a machine key whose raw value the caller already holds — the bootstrap counterpart to ApiKeyIssueRequest.

ApiKeyIssueRequest

Parameters for issuing a new API key.

IssuedApiKey

The one-time issuance result: the raw secret plus the stored descriptor. The raw key is shown exactly once here and never persisted — display it to the caller immediately; it cannot be recovered afterwards.

Interfaces

IApiKeyStore

Issues, validates, and revokes API keys — the machine-to-machine authentication plane. Keys are stored hashed (never in plaintext) and flow through the same membership/permission plane as human sign-ins: a machine key acts as its own actor with tenant-scoped roles, a personal access token acts as its bound user.