API Key Array

[corepay]

Made this request probably a year ago. Doing a new deployment with your lib and came back here to see if it was resolved one way or other and can't find the request so gonna lobby once again.

Possible to allow an array for static key option?

"api-key": {
      "headerField": "x-api-key", 
      "key": ["abcdef12345", "83736262893", "nd73g3923923823&%^62"]
    }

This will allow me to authenticate things like server-server keys and system admin keys without requiring a database table, lookup, maintenance etc. I have one use case where I am using a feathers server acting as proxy between an oauth server and feathers/sequelize server and a couple serverless endpoints - have rest api's, a php server on same overlay network and feathers/vuex static apps all hitting this proxy server - would like to provide initial api-key auth on this proxy server before sending to any upstream service and NOT have this server connected to DB. I could use the lib as is and issue a single static api key for all consumers but ideally would issue a key per consumer so no one consumer has the same key and I can revoke or change api-key per consumer if necessary. Doing this without a DB connnection to an API KEY table would require an array for static keys....si?

If this isn't part of your vision for the lib feel free to close.

Thank you.

[corepay]

??? I looked earlier and my original #1 was not in issues. It is now must have overlooked or something. Closing this one - do't want to come across as nag....

[TheSinding]

Hey @corepay. It's no problem, it's an open source project 👍

If you have a PR, then we can add it into the project :)
I don't have much time on my hands lately, so it would be appreciated 🎉

[TheSinding]

@corepay - Did you do any work on this ? :)
If you could add it as a PR, that would be great 👍

[corepay]

Hey hello…. I ended up rolling my own loosely based on some of your work here and the anonymous strategy. I pulled a key strategy out of my (air) that issued decrypted keys from 2 tables identifying the developer and the client app. Using a slightly modified anonymous strategy to evaluate an array of static keys for internal server-server auth… I am about to check in your refresh token lib sometime this week and give that a go -> cheers to ya!

…

On Feb 25, 2021, at 4:17 AM, Simon Sinding ***@***.***> wrote: @corepay <https://github.com/corepay> - Did you do any work on this ? :) If you could add it as a PR, that would be great 👍 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ALVZFG5KNYQ3DKJRVR57PW3TAYBS7ANCNFSM4S3FEBRQ>.

[corepay]

Hola,

Browsing through Feathers API and see they added this recipe that provides a solution here:

https://docs.feathersjs.com/cookbook/authentication/apiKey.html#api-key-authentication

Still need to create and reference a hook though - pretty much what I did already.

[TheSinding]

Yeah it seems like it.