Loading page
by Meec
Self-hosted API key management service built with Express and TypeScript. Handles admin authentication via JWT, complete API key lifecycle (create, rotate, revoke), usage tracking, and scope-based access control for protected routes. Includes rate limiting, SQLite persistence, and bcrypt-secured credentials—ready to deploy with configurable CORS and custom JWT secrets. Licensed under Tetrees License.
A self-hosted TypeScript backend API for managing API keys, admin authentication, and usage tracking. This module provides a complete API key lifecycle management system with JWT-based admin authentication, SQLite persistence, rate limiting, and protected route access control.
better-sqlite3| Component | Technology |
|---|---|
| Runtime | Node.js |
| Language | TypeScript |
| Framework | Express 5 |
| Database | SQLite (better-sqlite3) |
| Admin Auth | JWT + bcrypt |
| API Key Auth | Hashed keys with ak_live_ prefix |
| Security | Helmet, CORS |
| Logging | Morgan |
| ID Generation | UUID v4 |
| Rate Limiting | In-memory sliding window |
npm install
npm run build
npm start
Server listens on port 9030 by default.
npm run dev
Starts with hot-reload via ts-node/nodemon. Logs use short format: METHOD /path STATUS response-time ms.
Spin up an isolated sandbox and run it server-side — no local setup.
Push this product straight into your AI IDE, web builder or cloud IDE.
Download your licensed source snapshot from the library, then follow the setup guide in your workspace.
No reviews yet.
Sign in to join the discussion
Loading discussion…
| Variable | Required | Default | Description |
|---|---|---|---|
PORT | No | 9030 | HTTP server port |
JWT_SECRET | No | dev-secret-change-in-production | Admin JWT signing secret (change in production) |
ALLOWED_ORIGINS | No | * | Comma-separated CORS origins |
NODE_ENV | No | — | Set to production for combined log format |
GET /api/health
Returns server status. No authentication required.
curl http://localhost:9030/api/health
Response: { "status": "ok", "timestamp": "2024-07-15T12:00:00.000Z" }
All auth routes are rate-limited to 10 requests per 15 minutes per IP.
POST /api/auth/register
Register a new admin account. Returns JWT valid for 24 hours.
Request:
{
"username": "alice",
"password": "supersecret123"
}
Response 201:
{
"data": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"username": "alice",
"created_at": "2024-07-15T12:00:00.000Z",
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
}
POST /api/auth/login
Authenticate an existing admin. Returns fresh JWT.
Request:
{
"username": "alice",
"password": "supersecret123"
}
Response 200: Same as register.
GET /api/auth/me
Get authenticated admin's profile. Requires Authorization: Bearer <jwt>.
All /api/keys routes (except /api/keys/validate) require admin JWT:
Authorization: Bearer <admin_jwt>
POST /api/keys
Create a new API key. Full raw key (ak_live_...) returned once in raw_key.
Request:
{
"name": "Production Key",
"scopes": ["read:data", "write:data"],
"rate_limit": 500,
"rate_window": 60,
"expires_at": "2025-12-31T23:59:59.000Z"
}
Response 201:
{
"data": {
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"name": "Production Key",
"key_prefix": "ak_live_",
"raw_key": "ak_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"owner_id": "550e8400-e29b-41d4-a716-446655440000",
"scopes": ["read:data", "write:data"],
"rate_limit": 500,
"rate_window": 60,
"status": "active",
"expires_at": "2025-12-31T23:59:59.000Z",
"created_at": "2024-07-15T12:00:00.000Z",
"updated_at": "2024-07-15T12:00:00.000Z"
}
}
GET /api/keys
List all API keys owned by authenticated admin.
Response 200: Array of key objects (without raw_key).
GET /api/keys/dashboard
Get aggregated dashboard statistics.
Response 200:
{
"data": {
"total": 3,
"active": 2,
"revoked": 1,
"expired": 0,
"total_requests": 1482
}
}
GET /api/keys/:id
Retrieve a single API key by UUID.
Response 200: Key object.
PATCH /api/keys/:id
Update mutable fields (name, scopes, rate_limit, rate_window, expires_at).
Request:
{
"name": "Production Key v2",
"rate_limit": 1000,
"scopes": ["read:data", "write:data", "admin"]
}
Response 200: Updated key object.
POST /api/keys/:id/revoke
Revoke an active API key. Revoked keys are immediately rejected. Record preserved for audit.
Response 200: Key object with status: "revoked".
POST /api/keys/:id/rotate
Rotate an API key (generate new raw key). Returns new raw_key once.
Response 200: Key object with new raw_key.
POST /api/keys/:id/activate
Reactivate a revoked key.
Response 200: Key object with status: "active".
DELETE /api/keys/:id
Permanently delete an API key record.
Response 200: Deleted key object.
POST /api/keys/validate
Validate an API key. No authentication required. Used by protected routes.
Request:
{
"api_key": "ak_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"scope": "read:data"
}
Response 200:
{
"data": {
"valid": true,
"key_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"owner_id": "550e8400-e29b-41d4-a716-446655440000",
"scopes": ["read:data", "write:data"],
"rate_limit": 500,
"rate_window": 60
}
}
GET /api/usage
Get aggregated usage stats for all keys owned by authenticated admin.
Response 200: Usage summary object.
GET /api/usage/:id
Get usage stats for a specific API key.
Response 200: Per-key usage object.
Example protected endpoints requiring valid API key:
GET /api/protected/ping
Simple health check. Requires valid API key in Authorization: Bearer <api_key>.
Response 200: { "data": { "message": "pong" } }
GET /api/protected/data
Requires read:data scope.
POST /api/protected/data
Requires write:data scope.
GET /api/protected/admin-only
Requires admin JWT (not API key).
GET /api/protected/admin
Requires admin JWT.
GET /api/protected
Requires valid API key.
23 endpoints tested | 22/23 passed
All core functionality verified: authentication, key management, validation, usage tracking, and protected routes. See TEST_RESULTS.md for detailed results.
Tetrees License
The sandbox audition completed and the detected runnable path passed.
This Express backend / api completed archive review with strong static results. Structure, dependency manifests, documentation, functional source, and common risk patterns were checked by the Tetrees verification pipeline; runtime phases are stated separately. Final verified scores after isolated runtime evidence: overall 8.5 and security 9.
Deterministic AVCP artifact review
Pipeline avcp-2026-08-04.1 · SHA-256 b39de67edef77ca1…
This version-scoped review deterministically inspects the submitted archive for structure, dependencies, documentation, functional source, and common malicious or high-risk signals. Build and test phases are reported as passed only after an isolated sandbox audition. It is not a guarantee of perfect security.
Reviewed Aug 4, 2026
The full install guide and integration prompts unlock after purchase.
CRM, ERP, Admin & Internal Tools
$18.12