Managing API keys via REST API

[acelaya]

Traditionally, Shlink las only allowed managing API keys through its built-in CLI tool.

The reason was that exposing this, would introduce some security concerns. Keeping it in the CLI forces you to have physical access to the server.

However, even though nobody has ever asked for it, there are valid reasons to expose it, like an eventual external CLI for Shlink that interacts with a server via API.

[notflip]

Is this something that's still on the radar?

[khanh-momos]

@acelaya I'm hosting Shlink in our ECS Fargate containers. Can you suggest a good approach to manage the API keys?

[welsh]

@acelaya any update?

We're looking to host on GCP Cloud Run but won't have access to the container itself, so we only have the Initial API key (set via environment variable INITIAL_API_KEY) available unless I've missed something.

[wfjsw]

I am having a quite mixed opinion on this.

This definitely helps with the automated creation of API key, but in my setup with API key injected by the reverse proxy through the SSO process, I would almost never want to see these keys being echoed back somehow. (I know about the shlink dashboard, but that is a whole another user repository and service to maintain)

[acelaya]

I might consider allowing this to be opt-in, so that you can choose in your own instance if it should be possible to manage API keys via the API or just via CLI.

However, I don't think I ever do this unless I have a clear use case for it (like an external CLI tool, as originally mentioned)