Loading page
由 Meec 出售
Self-hosted API key management service built with Express and TypeScript. Handles admin authentication via JWT, complete API key lifecycle (create, rotate, revoke), usage tracking, and scope-based access control for protected routes. Includes rate limiting, SQLite persistence, and bcrypt-secured credentials—ready to deploy with configurable CORS and custom JWT secrets. Licensed under Tetrees License.
A self-hosted TypeScript backend API for managing API keys, admin authentication, and usage tracking. This module provides a complete API key lifecycle management system with JWT-based admin authentication, SQLite persistence, rate limiting, and protected route access control.
better-sqlite3| Component | Technology |
|---|---|
| Runtime | Node.js |
| Language | TypeScript |
| Framework | Express 5 |
| Database | SQLite (better-sqlite3) |
| Admin Auth | JWT + bcrypt |
| API Key Auth | Hashed keys with ak_live_ prefix |
| Security | Helmet, CORS |
| Logging | Morgan |
| ID Generation | UUID v4 |
| Rate Limiting | In-memory sliding window |
npm install
npm run build
npm start
Server listens on port 9030 by default.
npm run dev
Starts with hot-reload via ts-node/nodemon. Logs use short format: METHOD /path STATUS response-time ms.
启动隔离沙箱并在服务器端直接运行 — 无需本地配置。
将此产品直接导入你的 AI IDE、网页构建器或云端 IDE。
将 Tetrees 连接到兼容的 AI IDE，列出你拥有的产品并获取已验证 ZIP，同时不会开放卖家上传权限。
暂无评价。
Sign in to join the discussion
Loading discussion…
| Variable | Required | Default | Description |
|---|---|---|---|
PORT | No | 9030 | HTTP server port |
JWT_SECRET | No | dev-secret-change-in-production | Admin JWT signing secret (change in production) |
ALLOWED_ORIGINS | No | * | Comma-separated CORS origins |
NODE_ENV | No | — | Set to production for combined log format |
GET /api/health
Returns server status. No authentication required.
curl http://localhost:9030/api/health
Response: { "status": "ok", "timestamp": "2024-07-15T12:00:00.000Z" }
All auth routes are rate-limited to 10 requests per 15 minutes per IP.
POST /api/auth/register
Register a new admin account. Returns JWT valid for 24 hours.
Request:
{
"username": "alice",
"password": "supersecret123"
}
Response 201:
{
"data": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"username": "alice",
"created_at": "2024-07-15T12:00:00.000Z",
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
}
POST /api/auth/login
Authenticate an existing admin. Returns fresh JWT.
Request:
{
"username": "alice",
"password": "supersecret123"
}
Response 200: Same as register.
GET /api/auth/me
Get authenticated admin's profile. Requires Authorization: Bearer <jwt>.
All /api/keys routes (except /api/keys/validate) require admin JWT:
Authorization: Bearer <admin_jwt>
POST /api/keys
Create a new API key. Full raw key (ak_live_...) returned once in raw_key.
Request:
{
"name": "Production Key",
"scopes": ["read:data", "write:data"],
"rate_limit": 500,
"rate_window": 60,
"expires_at": "2025-12-31T23:59:59.000Z"
}
Response 201:
{
"data": {
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"name": "Production Key",
"key_prefix": "ak_live_",
"raw_key": "ak_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"owner_id": "550e8400-e29b-41d4-a716-446655440000",
"scopes": ["read:data", "write:data"],
"rate_limit": 500,
"rate_window": 60,
"status": "active",
"expires_at": "2025-12-31T23:59:59.000Z",
"created_at": "2024-07-15T12:00:00.000Z",
"updated_at": "2024-07-15T12:00:00.000Z"
}
}
GET /api/keys
List all API keys owned by authenticated admin.
Response 200: Array of key objects (without raw_key).
GET /api/keys/dashboard
Get aggregated dashboard statistics.
Response 200:
{
"data": {
"total": 3,
"active": 2,
"revoked": 1,
"expired": 0,
"total_requests": 1482
}
}
GET /api/keys/:id
Retrieve a single API key by UUID.
Response 200: Key object.
PATCH /api/keys/:id
Update mutable fields (name, scopes, rate_limit, rate_window, expires_at).
Request:
{
"name": "Production Key v2",
"rate_limit": 1000,
"scopes": ["read:data", "write:data", "admin"]
}
Response 200: Updated key object.
POST /api/keys/:id/revoke
Revoke an active API key. Revoked keys are immediately rejected. Record preserved for audit.
Response 200: Key object with status: "revoked".
POST /api/keys/:id/rotate
Rotate an API key (generate new raw key). Returns new raw_key once.
Response 200: Key object with new raw_key.
POST /api/keys/:id/activate
Reactivate a revoked key.
Response 200: Key object with status: "active".
DELETE /api/keys/:id
Permanently delete an API key record.
Response 200: Deleted key object.
POST /api/keys/validate
Validate an API key. No authentication required. Used by protected routes.
Request:
{
"api_key": "ak_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"scope": "read:data"
}
Response 200:
{
"data": {
"valid": true,
"key_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"owner_id": "550e8400-e29b-41d4-a716-446655440000",
"scopes": ["read:data", "write:data"],
"rate_limit": 500,
"rate_window": 60
}
}
GET /api/usage
Get aggregated usage stats for all keys owned by authenticated admin.
Response 200: Usage summary object.
GET /api/usage/:id
Get usage stats for a specific API key.
Response 200: Per-key usage object.
Example protected endpoints requiring valid API key:
GET /api/protected/ping
Simple health check. Requires valid API key in Authorization: Bearer <api_key>.
Response 200: { "data": { "message": "pong" } }
GET /api/protected/data
Requires read:data scope.
POST /api/protected/data
Requires write:data scope.
GET /api/protected/admin-only
Requires admin JWT (not API key).
GET /api/protected/admin
Requires admin JWT.
GET /api/protected
Requires valid API key.
23 endpoints tested | 22/23 passed
All core functionality verified: authentication, key management, validation, usage tracking, and protected routes. See TEST_RESULTS.md for detailed results.
Tetrees License
沙箱验证已完成，检测到的可运行路径已通过。
This Express backend / api completed archive review with strong static results. Structure, dependency manifests, documentation, functional source, and common risk patterns were checked by the Tetrees verification pipeline; runtime phases are stated separately. Final verified scores after isolated runtime evidence: overall 8.5 and security 9.
Deterministic AVCP artifact review
管道 avcp-2026-08-04.1 · SHA-256 b39de67edef77ca1…
This version-scoped review deterministically inspects the submitted archive for structure, dependencies, documentation, functional source, and common malicious or high-risk signals. Build and test phases are reported as passed only after an isolated sandbox audition. It is not a guarantee of perfect security.
审查日期 2026年8月4日
完整安装指南与集成提示词将在购买后解锁。
CRM, ERP, Admin & Internal Tools
US$18.12