v0.28: API key updates

[guimachiavelli]

v0.28 introduces many changes to the generation and management of API keys.

New field: name

name is a field accepting a short description of a key for easy reference. This is in addition to the description field, which should be used for longer and more detailed information on a key.

New field: uid

This field is optional; it can be specified when the user must generate deterministic keys.

/keys route

Resources returned by the /keys endpoint will be paginated. This means two new parameters for the /keys endpoint: limit and offset. Responses will also include three new fields: limit, offset, and total. By default, the new limit parameter is 20, meaning pagination is only likely to be relevant in instances with >20 API keys

PATCH endpoint only allows updates to name and description fields.

When using the GET endpoint to get a specific key, either the uid or the full key value can be used.

Tenant tokens

apiKeyPrefix renamed to apiKeyUid.

New actions

Supported permissions for an API key now include: keys.get, keys.create, keys.update, and keys.delete.

References

Spec:

• general: API Keys - Determinist API Keys + Security changes specifications#148
• pagination: API Guideline - Return list of API resources under a results array specifications#138
  Issues on core:
• general: Change of the API key resource meilisearch#2369
• pagination: Pagination of the /keys ressources meilisearch#2442
  SME: @ManyTheFish, @gmourier

[dichotommy]

PATCH endpoint only allows updates to name and description fields.

If accurate, this is a biiiig change from the current version, in which update keys method allows you to update the actions and indexes for a key. Could we have confirmation on this @gmourier @curquiza ?

[gmourier]

It will not be possible to update API keys anymore on those fields, actions, indexes, and expiresAt.

This is done to bring more security by design into the product, today it is very easy to introduce unwanted side effects by modifying a key's critical fields without knowing where it is used and thus giving an escalation of rights somewhere.