Client API Key — Design (Lite) ออกแบบ API key service to service ให้เบาและยังถูกต้อง

The design for a lightweight API key service aims to provide a simple and secure solution for service-to-service communication. The key focuses on six columns and ten lines of functions, making it easy for anyone to implement. The main goal is to ensure that only authorized services can access the API without revealing the key to end-users.

The lite design does not include scopes, cache, CLI, or unique constraints on the consumer column. This simplification aims to keep the implementation lightweight and efficient. The key hash is stored in an environment variable, while the key itself remains secret. The revoke process checks the timestamp in the query rather than the code, ensuring accurate and secure revocation.

The primary design decisions revolve around not storing the key directly, revoking keys using timestamps, and avoiding the inclusion of UNIQUE constraints on the consumer column. By not storing the key, unauthorized access is minimized. Timestamp-based revocation allows for efficient revocation checks in queries. Excluding UNIQUE constraints reduces complexity and enables key rotation when necessary.

The CREATE TABLE statement outlines the six columns: ID, consumer, key_hash, revoked_at, description, and created_at. The key_hash is stored as a SHA256 hexadecimal value, making authentication secure without requiring bcrypt. The revocation timestamp is stored to track when a key was revoked, providing transparency and accountability.

To revoke a key, update the last_used_at timestamp in the query. This ensures that revoked keys are easily identifiable and can be revoked promptly. The UNIQUE constraint on the consumer column is optional and can be added later if needed. Key rotation is recommended to maintain security, but it involves dropping and recreating the table. When a key is revoked, a new key must be deployed, and consumers must switch to the new key. This process ensures that revoked keys are no longer valid while maintaining minimal downtime.