feat(api-keys): read-only API keys and expiry at creation by waleedlatif1 · Pull Request #9855 · simstudioai/sim

waleedlatif1 · 2026-11-10T21:25:45Z

Summary

Adds read-only API keys: api_key.access (read | write, default write, migration 0455, metadata-only) carried on personal and workspace key principals
A read key is granted api:read in the operation funnel, the same classification OAuth tokens already use, and is refused with 403 READ_ONLY_API_KEY on any write or unscoped operation. Surfaces that authorize outside the funnel refuse explicitly: v1 non-GET (except knowledge search), legacy workflow execute, and workflow MCP tools/call
Lets callers choose an expiry at creation (1–366 days, or never); expired keys now get 401 API key has expired instead of a generic invalid-key error, checked after validity so foreign or banned keys still read as invalid
Settings create modal gains Access (Full access / Read only) and Expires (30 days, 90 days, 1 year, Never; default Never so existing flows are unchanged); deploy and workflow MCP flows always create full-access keys. Key rows show a Read only tag and expiry
/api/v2/meta reports the credential's scopes; the mothership-delegation: key-name prefix is reserved
Creating read keys is gated by the api-key-read-only feature flag (off by default); enforcement of read keys is never gated
Docs: authentication pages describe access levels, credit-consuming reads (search, search chat, selectors), and each surface's refusal shape

Rollout: turn api-key-read-only on only after every pod runs this release, since older pods ignore access and would serve a read key with full access. Rolling back below this release after read keys exist widens them the same way.

Type of Change

New feature

Testing

apps/sim/lib/api-key/__integration__/read-only-access.integration.ts (8 passing) against PostgreSQL: read keys refused on every write surface (v2, Sim MCP, v1, legacy execute, workflow MCP serve, resume/cancel) with no rows written, reads still succeed, pre-migration keys behave as write, expiry message on v2 and v1, flag-off creation and reserved names refused; reverting each guard turns its test red
Unit: principal serialization round-trip and old-format parse, scope enforcement, key auth, route policies, key creation, MCP handlers, execute and resume routes
tsc on apps/sim, check:test-types; check:migrations, schema-mock, openapi, cli-api, mcp-operations, cli-docs, api-validation:strict, principal-kind-parity, client-boundary, boundaries; root scripts and sim-cli suites; biome

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Personal and workspace API keys gain an access level (full access or read only) and an expiry picked when the key is created (30 days, 90 days, 1 year, or never; bounded server-side to one day through one year). A read-only key is granted the api:read scope: the operation funnel refuses it any operation api:read does not cover, including operations that declare no scope, with a 403 READ_ONLY_API_KEY refusal rather than an OAuth insufficient_scope challenge. Surfaces that authorize outside the funnel refuse it too: v1 refuses every non-GET except knowledge search, the legacy execute route refuses it, and a workflow MCP server refuses tools/call. An expired key now answers 401 "API key has expired" on v2, v1, and hybrid auth. /api/v2/meta reports the credential's scopes. Migration 0455 adds api_key.access (enum api_key_access, NOT NULL DEFAULT 'write'), so existing keys and the deployed app keep full access. Write keys serialize without the field and older serialized principals parse as write, so queued runs survive a mixed-version deploy.

…, share key principal builder - Create modal defaults Expires to Never; docs say so and note read-only keys keep search chat - Client key list defaults a missing access to write during deploy rollout - apiKeyPrincipal builds the key principal once for v1, hybrid, and workflow route auth - Auth result carries expired: true instead of callers matching the message text - Integration fixture uses valid table names; v2 create answers 201 - Serialized-principal test uses the wire shape; migration snapshot formatted

…docs - api-key-read-only flag (global, fallback API_KEY_READ_ONLY) gates creating read keys: the server answers 400 and the create modal hides Access while it is off. Enforcement of existing read keys is never gated, since older pods would serve them as full access - Reserve the mothership-delegation: key-name prefix so delegation minting can never adopt a user's key - Expiry is checked after every other key gate, so a foreign or banned key reports invalid - Workflow MCP serve and MCP discover answer an expired key with API key has expired - Share DAY_MS from the api-keys contract; the year bound's day of slack is for clock skew - Docs: per-surface refusal shapes, what read keys can still spend, and where the expiry message appears - Integration: flag-off and reserved-name refusals, v1 search asserts 200

vercel · 2026-11-10T21:25:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 10, 2026 10:04pm UTC

greptile-apps · 2026-11-10T21:29:46Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge with the documented rollout restriction.

Summary

Adds read-only API keys and optional expiration at creation.

Read-only API keys can read but cannot change resources or run workflows.
Key settings choose read or full access and when each key expires.
Existing API key test fixtures now include an access level.

No new actionable issues were found. The three previous unnumbered findings are addressed in the current code.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[API key request] --> B[Authenticate key and check expiry]
  B -->|Invalid or expired| C[401 response]
  B -->|Valid| D[Principal carries access]
  D --> E{Read-only key?}
  E -->|No| F[Existing permission checks]
  E -->|Yes| G{Operation permits reads?}
  G -->|No| H[403 READ_ONLY_API_KEY]
  G -->|Yes| F

_{Reviews (4) · Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed

_{Turn on auto-fix | Re-trigger cubic}

…only-expiry

waleedlatif1 · 2026-11-10T21:37:28Z

@greptile

waleedlatif1 · 2026-11-10T21:37:30Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-10T21:37:36Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 195 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…ction

…meta scopes - The account settings layout resolves api-key-read-only and wraps its sections in FeatureFlagsProvider, as the workspace and organization layouts do, so personal API key settings no longer throw from the create modal's flag read - The /api/v2/meta scopes description says read-only keys are also refused every operation that declares no API scope; OpenAPI regenerated

waleedlatif1 · 2026-11-10T21:52:45Z

@greptile

waleedlatif1 · 2026-11-10T21:52:46Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-10T21:52:52Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 202 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Turn on auto-fix | Re-trigger cubic}

…dered text

…only-expiry

waleedlatif1 · 2026-11-10T21:58:15Z

@greptile

waleedlatif1 · 2026-11-10T21:58:17Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-10T21:58:24Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 202 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Turn on auto-fix | Re-trigger cubic}

Renumber the personal-organization migrations 0455-0459 to 0456-0460 after staging's 0455_api_key_access, rechaining their snapshots and journal. Port read-only API keys and creation-time expiry (#9855) into the Platform: the create-key modal offers access (behind api-key-read-only) and expiry, the deploy dialog and MCP server detail issue full-access keys only, and the keys list shows a Read only tag and expiry. The flag is seeded through the organization surface. Legacy layouts and settings modified on staging stay deleted.

waleedlatif1 added 3 commits November 10, 2026 12:49

greptile-apps Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/settings/components/api-keys/api-keys.tsx Resolved

fix(api-keys): give the key row caption a props interface

f9686a4

vercel Bot temporarily deployed to Preview November 10, 2026 21:30 Inactive

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/lib/api-key/orchestration/index.ts Resolved

waleedlatif1 added 2 commits November 10, 2026 13:34

fix(api-keys): surface key validation errors from Copilot key creation

647685d

Merge remote-tracking branch 'origin/staging' into feat/api-key-read-…

25e1183

…only-expiry

greptile-apps Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread ...aceId]/settings/components/api-keys/components/create-api-key-modal/create-api-key-modal.tsx Resolved

vercel Bot deployed to Preview November 10, 2026 21:41

View deployment

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/docs/openapi-v2-resources.json Resolved

test(api-keys): compare audit actors with the principal's actor proje…

0d6c376

…ction

vercel Bot temporarily deployed to Preview November 10, 2026 21:43 Inactive

greptile-apps Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/app/account/settings/layout.test.tsx Resolved

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

test(api-keys): assert the account layout's flag value instead of ren…

329c120

…dered text

vercel Bot temporarily deployed to Preview November 10, 2026 21:56 Inactive

Merge remote-tracking branch 'origin/staging' into feat/api-key-read-…

c5cec7d

…only-expiry

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

vercel Bot deployed to Preview November 10, 2026 22:04

View deployment

waleedlatif1 merged commit 02293a9 into staging Nov 10, 2026
91 checks passed

waleedlatif1 deleted the feat/api-key-read-only-expiry branch November 10, 2026 23:04

waleedlatif1 mentioned this pull request Nov 11, 2026

v0.9.53: saved credentials with keyless AWS and Databricks OIDC, read-only API keys, workspace members endpoint, trigger health and pinned versions, proxy support, search source permissions #9871

Merged

Conversation

waleedlatif1 commented Nov 10, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 10, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 10, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 10, 2026 •

edited

Loading

greptile-apps Bot commented Nov 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading