Metadata-Version: 2.5
Name: simple_module_api_tokens
Version: 0.0.37
Summary: Personal access tokens and service API keys for simple_module
Project-URL: Homepage, https://github.com/antosubash/simple_module_python
Project-URL: Repository, https://github.com/antosubash/simple_module_python
Project-URL: Issues, https://github.com/antosubash/simple_module_python/issues
Project-URL: Changelog, https://github.com/antosubash/simple_module_python/blob/main/CHANGELOG.md
Author-email: Anto Subash <antosubash@live.com>
License-Expression: MIT
License-File: LICENSE
Keywords: api-keys,api-tokens,fastapi,personal-access-tokens,simple-module
Classifier: Development Status :: 3 - Alpha
Classifier: Framework :: FastAPI
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
Classifier: Typing :: Typed
Requires-Python: >=3.12
Requires-Dist: simple-module-auth==0.0.37
Requires-Dist: simple-module-core==0.0.37
Requires-Dist: simple-module-db==0.0.37
Requires-Dist: simple-module-hosting==0.0.37
Requires-Dist: simple-module-inertia==0.0.37
Requires-Dist: simple-module-settings==0.0.37
Requires-Dist: simple-module-users==0.0.37
Description-Content-Type: text/markdown

# simple_module_api_tokens

Personal access tokens and service API keys for
[simple_module](https://github.com/antosubash/simple_module_python) apps.

- `smpat_…` tokens act for their owner, `smsk_…` service keys act for no one,
  with roles chosen at creation (never `admin`) and a pinned tenant.
- Every token carries **scopes**, which cap what it can do on every request,
  even when its owner is an admin. Demoting the owner shrinks the token at once.
- Only `sha256(token)` is stored, and the secret is shown once. Revocation
  applies on the next request.
- Tokens can only be created, listed and revoked from a signed-in browser
  session, with a CSRF token.

## Install

```bash
pip install simple_module_api_tokens
```

Add `simple_module_api_tokens` to your host's dependencies and generate a
migration. It needs the `auth`, `users` and `settings` modules.

## Usage

```bash
curl -H "Authorization: Bearer smpat_…" https://app.example.com/api/feature_flags/
```

| Route | Page | Purpose |
|---|---|---|
| `GET /api-tokens/` | `ApiTokens/Index` | Your own tokens (`api_tokens.use`) |
| `GET /admin/api-tokens/` | `ApiTokens/Admin` | All tokens and service keys (`api_tokens.manage`) |

Settings: `max_lifetime_days` (default 365), DB-backed.

See [docs/modules/api_tokens.md](https://github.com/antosubash/simple_module_python/blob/main/docs/modules/api_tokens.md)
for the resolution order, the scope cap and the tenancy rules.
