From 99f5e799a4d44d1026b874d67ac1a68740ccd371 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Thu, 13 Aug 2026 08:54:42 +0000 Subject: [PATCH] feat: Give API keys their own page and group the sidebar MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The token management card sat on /settings, which is owner|admin throughout, so it hid a capability every member already had: the API has never required a role to mint or revoke your own key. It is now the /api-keys page, reachable at every role, with the instance-wide lifetime cap left behind on /settings because that is policy rather than one person's credentials — and that split is what lets the page be ungated. The sidebar gains groups: Fleet, Access, Automation, Instance, each with a small-caps heading and a rule above it. Grouping is by what the operator is doing rather than by which service answers, so SSH keys, secrets and API keys sit together as credentials. A group whose every item is admin-only disappears whole for a member; a labelled section with nothing under it reads as a failure rather than a restriction. The UI says keys while the collection, prefix and routes still say tokens. Renaming a published endpoint to match a nav label would break every script already written against it. --- docs/reference/api-tokens.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/reference/api-tokens.md b/docs/reference/api-tokens.md index d587def..6d4af65 100644 --- a/docs/reference/api-tokens.md +++ b/docs/reference/api-tokens.md @@ -9,8 +9,10 @@ needs something it can hold onto instead — an API token. ## Creating one -Settings → **Access** → API tokens. Give it a name, a role (owner, admin or -member) and one or more scopes, and optionally an expiry. The value is shown +**API Keys**, in the Access group of the sidebar. The page is reachable at +every role: any member may create and revoke their own keys, and owner and +admin additionally see every key in the instance. Give it a name, a role +(owner, admin or member) and one or more scopes, and optionally an expiry. The value is shown once, in full, immediately after creation: ``` @@ -54,7 +56,7 @@ independent of its owner. ## Expiry An expiry is optional on a token you create. An instance can set a -**maximum token lifetime** (Settings → Access) that caps how far out a new +**maximum key lifetime** (Settings → Integrations) that caps how far out a new token's expiry may be set; when that cap is in place, a token with no expiry at all is refused, so there is no way to route around the policy by leaving the field blank.