Support multiple API keys.
Support for multiple api keys per account allows for individual revocation, and allowing access to multiple apps. Also, granting permission from certain keys, to certain servers (or multiple servers) would allow even greater control, without much added implementation.
7 comments
-
Jean-Philippe Boily commented
Sorry, just saw your answer, even if it was like 4 minutes after my previous post. Probably got in my spam.
Anyways, I think this does make sense to review the API auth to possibly use xAuth or oAuth.
-
Was mis-classified this was for multiple SSH keys during droplet creation.
We are in the process of reviewing API authentication and looking into support for xAuth or oAuth to allow third party apps to be built without the need to authenticate with API credentials since those are difficult to pass into mobile apps for example, so a more refined API auth scheme is something we will add into the review.
-
Darrin Wortlehock
commented
Please re-classify this. it is not completed, it appears it has been rejected.
-
Why cant you add another key?
-
Jean-Philippe Boily commented
Hi,
it seems that this is marked as being completed by I can't add a second API key to my account right now as it would reset the current one. I don't see anything in API doc about that either.Having more than one API key is essential to me if I want to, say, test an app and revoke rights after. One API key for Android app, one for custom stuff.
Did I miss something?
Thanks!
-
SSH keys support has been added to the API through the new parameter:
&ssh_key_ids=ssh_key_id1,ssh_key_id2,etc.
Thanks
-
Hi Ian,
Can you give me a few use cases to better understand what you are looking to achieve and how you would like this to function.
Reason being that creating more granular access for API keys to act on specific servers would move the API interpretation out of the user model and into the droplet model to determine whether a specific key pair would have authority to act on a server.
Given that the most common way to access this would be through a user instead it would overlap with that so it would a significant amount of overhead both in terms of code and also in maintaining the functionality going forward.
Want to make sure that I understand the use cases first to see what's the ultimate result you are looking to achieve in the real world to see if perhaps there's another approach that could be used that would have less overhead.