Integration: API keys

Route: /integration/api-keys. Component: ApiKeysPage.dc.html, mounted by AppFrame.

Visual reference: RenewCMS Screens API keys.dc.html.

API

POST /v1/api-key · GET /v1/api-key · DELETE /v1/api-key/{id}. Access: Session only. An API key cannot manage keys; with a key these routes answer 403 "This action needs a real session."

POST /v1/api-key body: name (string, required, max 60), expires_at (RFC3339 string, optional, in the future). A past date answers 400 "The expiry must be a date in the future."
DELETE /v1/api-key/{id}: unknown id answers 404 "API key not found".

Placement

Under Integration, as a sub-page linked from the Authentication section ("Manage API keys") and the sidebar item. Keys exist to call the API and admins can create them; Settings is owner-only today. The mobile top bar has a back arrow that returns to Integration.

Content

Columns: Name, Key (prefix, mono), Status (active, expired, revoked), Created by (owners only), Created, Last used, Expires, Revoke. Owners see all keys; admins see their own.
Create key modal: Name (required, up to 60, counter), Expiry date (optional, must be in the future). Errors: "Enter a name." / "Use 60 characters or fewer." / "Choose a date in the future."
The Expiry field is a native date input. The displayed format follows the browser's locale, so there is no custom format. The board draws one example date only.
One-time reveal: warning "You won't be able to see this key again.", the key in a CodeSnippet with one tab ("API key") and Copy / Copied, "Closing this window discards the key from the screen. Copy it first." Button "Done".
Revoke: "Revoke this key?" / ""Nightly media import" (rcms_Mq7b…) will stop working right away. Requests that use it answer 401. This can't be undone." Buttons "Keep key", "Revoke key". Toast "Key revoked".
Empty: "No API keys yet" / "Create a key to call the API from a script or service." Error: "Couldn't load your API keys" / "Check your connection and try again."
Note: "Resetting a user's password revokes all of their keys."

Mobile: pinned Create key

On mobile the "Create key" button is pinned to the bottom of the viewport (44 px high, full width, on a bar with a top border). It shows in Owner list, Admin own keys only, Loading, Empty, Error and Revoked, and is hidden behind every modal state. In Empty it replaces the inline button. The content has bottom padding so nothing sits under the bar, and the toast sits above it. Desktop keeps "Create key" in the page header (and in the Empty card).

States

Names are matched exactly by the visual-check script.

Owner: list
Admin: own keys only
Loading: the list request is in flight. Skeleton rows appear only after 150 ms.
Empty
Error: a 500 or network failure on the list request. If a key is created while this state is showing, the list reloads, the new key appears and the error alert is cleared.
Create key
Create key: validation
Create key: name too long
One-time reveal
One-time reveal: copied
Revoke: confirm
Revoked

Component inventory (Nuxt UI v4)

UTable, UBadge, UModal (dialog on desktop, bottom sheet on mobile, footer secondary left and primary right) with UForm/UFormField/UInput (type date), UAlert color warning, UButton, CodeSnippet for the key.

Copy per state (generated from the board source, pass 2)

Every state below is drawn in light and dark (theme switch on the board), at 1440×900 and 390×844 (both frames sit side by side). Board: RenewCMS Screens API keys.dc.html. Copy is exact; where a cell is empty the state reuses the fixed copy.

API keys (group "API keys", 12 states)

Route: /integration/api-keys. API: GET /v1/api-key · POST /v1/api-key · DELETE /v1/api-key/{id} (session only).

Recommendation: place it under Integration, as a sub-page linked from the Authentication section and from the sidebar item. Keys exist to call the API, so they belong next to the reference. Settings is owner-only today, but admins can also create keys. The screen is session only: an API key cannot manage keys. Key name: required, up to 60 characters. Expiry: optional, in the future. A key is shown in full once; afterwards only its prefix is visible.

#	State	Trigger	Copy
1	Owner: list	Owners see every user's keys and a "Created by" column. Expired keys keep their Revoke action.	"Integration" / "API keys"
2	Admin: own keys only	Admins see only the keys they created, with no "Created by" column.	"Integration" / "API keys"
3	Loading	The list request is in flight. Skeleton rows appear after 150 ms.	"Integration" / "API keys"
4	Empty	No keys yet.	"Integration" / "API keys"
5	Error	A 500 or network failure on the list request.	"Integration" / "API keys"
6	Create key	"Create key" in the page header, or the bottom action on mobile. Name is required and limited to 60 characters; expiry is optional.	"Integration" / "API keys"
7	Create key: validation	On submit or blur. Nothing is sent. The name is empty and the expiry is in the past.	"Integration" / "API keys"
8	Create key: name too long	Over 60 characters. Checked as you type.	"Integration" / "API keys"
9	One-time reveal	201: the full key is shown once. Closing the dialog discards it from the screen.	"Integration" / "API keys"
10	One-time reveal: copied	Copy was pressed. The button reads "Copied" for 2 s and this is announced.	"Integration" / "API keys"
11	Revoke: confirm	Revoke on an active or expired row.	"Integration" / "API keys"
12	Revoked	204: the key stays in the list, greyed, with no Revoke action. A toast confirms.	"Integration" / "API keys"

5.7 KiB Raw Blame History Unescape Escape