[Security] Add API Key Rotation Support

[Abd-Standard]

Description

Allow administrators to rotate API credentials without downtime.

Acceptance Criteria
Multiple keys can coexist temporarily.
Old keys can be revoked safely.
Rotation process is documented.

[Babigdk]

Proposal: API Key Rotation Support (Zero-Downtime Credential Management)

I’d like to implement secure API key rotation to allow administrators to update credentials without service disruption.

Scope of Work:

• Support multiple active API keys simultaneously (key versioning or key list)
• Implement key validation middleware that checks against active key store
• Add safe revocation mechanism for individual keys without affecting others
• Ensure backward compatibility during rotation window
• Add optional key metadata (createdAt, revokedAt, status: active/revoked)

Implementation Approach:

• Introduce a key registry (in-memory or persistent store depending on config)
• Validate requests against all non-revoked keys
• Allow gradual deactivation of old keys
• Ensure no downtime during key swap (dual-key overlap period)

Deliverables:

• Multi-key authentication system
• Key rotation and revocation logic
• Secure middleware updates
• Documentation describing rotation workflow and best practices

Goal:
Enable secure, zero-downtime API credential rotation while maintaining backward compatibility and operational safety.

[leocagli]

Hi! I'd like to implement API key rotation — a rotate button in settings that calls the backend to generate a new key, invalidates the old one, and shows the new key once with a copy prompt. Could I be assigned?

[OmniZlatoon]

Hi maintainer sir, I'm called Junior Brown , a full-stack and smart contract engineer building on Stellar. I specialize in designing and shipping scalable, secure systems end-to-end, from Soroban smart contracts to production-ready backend infrastructure and user-facing applications.

[bobo-24]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. I’ll prioritize this immediately and ensure a reliable solution is delivered as soon as possible. Thank you!