core: implement API key authentication for vendors

[EmeditWeb]

Problem

Vendors need a programmatic way to integrate with
StepFi. Wallet-based JWT auth is not practical for
server-to-server communication.

What To Build

1. Create api_keys table in Supabase
2. CRUD endpoints for API key management
3. ApiKeyGuard for vendor endpoints

Files To Touch

• src/auth/guards/api-key.guard.ts (new)
• src/modules/vendors/vendors.controller.ts
• src/modules/vendors/vendors.service.ts
• supabase/migrations/[ts]_api_keys.sql

Acceptance Criteria

• API key generated and returned once
• Only hash stored in database
• ApiKeyGuard correctly authenticates
• Permissions enforced per key
• npm run build passes

Mandatory Checks Before PR

• npm run build passes
• No any types
• Unit tests for ApiKeyGuard
• PR references this issue

[EneGab]

I would like to work on this issue as quick as possible

[teeschima]

Hi,

I'd like to work on this issue.

My understanding is that the goal is to introduce API-key based authentication for vendor-to-server integrations, replacing the need for wallet-based JWT authentication in machine-to-machine communication.

My implementation plan would be:

• Create an api_keys table in Supabase with support for key metadata, permissions, status, timestamps, and vendor association.
• Generate cryptographically secure API keys and return the plaintext key only once during creation.
• Store only a hashed version of the key in the database.
• Implement CRUD endpoints for API key management in the vendors module.
• Create an ApiKeyGuard that validates incoming API keys and authenticates requests.
• Enforce permission scopes per key for protected vendor endpoints.
• Add unit tests covering successful authentication, invalid keys, revoked keys, and permission enforcement.
• Maintain strict TypeScript typing with no any usage.
• Verify npm run build passes before opening the PR.
• Reference this issue in the PR and include testing details.

I have experience with TypeScript, NestJS-style backend architectures, authentication systems, REST APIs, database design, and secure credential management.

Looking forward to contributing.

[khaylebfortune]

Hello Maintainer, I can fix this issue

[divicbold47]

Hello maintainer, pls assign me this task

[deslawson]

id love to work on this as it goes in line with my experience

[grantfox-oss]

🦊 GrantFox — @deslawson has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #34)
2. Your PR will be reviewed by the StepFi-app maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@deslawson's PR #60 was approved and merged by @EmeditWeb.

🏆 @deslawson: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (611 total points). Track your full progress on GrantFox.

👏 Great work, @deslawson! Keep contributing to StepFi-app.