struct

Arcana::Auth::ApiKey

An API key. The full secret is shown exactly once (at creation time) and never stored — only its SHA-256 hash and a public prefix are persisted.

Format: ak_<32 random base36-ish chars> prefix = first 11 characters (e.g. "ak_a1b2c3d4") hash = SHA-256 of the full string

org_id is nullable to allow a system-wide platform admin key. All other keys are scoped to exactly one org.

Constants

PREFIX_LEN = 11

Constructors

new(id : Int64, org_id : Int64 | Nil, prefix : String, hash : String, name : String, scope : String, created_at : Time, last_used_at : Time | Nil, revoked_at : Time | Nil)

Source

Class methods

create(name : String, org_id : Int64 | Nil = nil, scope : String = "full") : Tuple(ApiKey, String)

Create a new API key. Returns a tuple of {ApiKey, plaintext_secret} — the plaintext is only available here, exactly once.

Source

find_by_prefix(prefix : String) : ApiKey | Nil

Look up an active key by its prefix (the publicly visible part).

Source

list_for_org(org_id : Int64) : Array(ApiKey)

Source

verify(secret : String) : ApiKey | Nil

Verify a presented secret. Returns the matching ApiKey or nil. Does constant-time comparison of the hash.

Source

Instance methods

created_at

Source

created_at=(created_at : Time)

Source

hash

Generates an UInt64 hash value for this object.

This method must have the property that a == b implies a.hash == b.hash.

The hash value is used along with == by the Hash class to determine if two objects reference the same hash key.

Subclasses must not override this method. Instead, they must define hash(hasher), though usually the macro def_hash can be used to generate this method.

hash=(hash : String)

id=(id : Int64)

last_used_at

last_used_at=(last_used_at : Time | Nil)

Source

name

Source

name=(name : String)