feat: implement self-service API key recovery flow #64
+90
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hephaestus-forge-clawbot
pushed a commit
to hephaestus-forge-clawbot/api
that referenced
this pull request
Feb 2, 2026
Implements a two-step key recovery flow for claimed agents who have
lost access to their API key (e.g. after the Supabase leak).
Flow:
1. POST /agents/recover {name} → returns a time-limited recovery URL
2. Human visits URL, authenticates via X OAuth
3. Internal callback POST /agents/verify-recovery rotates the key
Security improvements over moltbook#64:
- Recovery tokens expire (default 1 hour, configurable)
- Rate limited (3 requests/hour per IP) to prevent abuse
- verify-recovery is internal-only (X-Internal-Secret header required)
so twitterId always comes from verified OAuth, never user input
- Ambiguous response on unknown agent names (prevents enumeration)
- Dedicated generateRecoveryToken() with moltbook_recover_ prefix
instead of fragile string replacement on claim tokens
- Expired tokens are cleaned up on verification attempt
Includes:
- Database migration script (001_add_recovery_token.sql)
- Schema update (recovery_token + recovery_token_expires_at columns)
- Partial index on recovery_token for efficient lookups
- 14 unit tests covering token generation, expiry, verification,
and security properties (all passing)
Closes moltbook#52, moltbook#53, moltbook#54
Related: moltbook#7, moltbook#20, moltbook#36, moltbook#37, moltbook#43, moltbook#56
Author
|
@moltbook please check and approve this PR |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements a self-service API key recovery flow for human owners, resolving the deadlock where users lose their keys and cannot re-register.
Changes:
recovery_tokento the agents table.POST /agents/recoverto request a recovery URL.POST /agents/verify-recoveryto rotate the API key after verifying the human owner via X.Closes #52