Scoped API tokens for headless importers #3

New Issue

GKaszewski · 2026-08-26T09:13:01Z

GKaszewski commented

2026-08-26 09:13:01 +00:00

What to build

Implements ADR 0003. Users mint named, revocable, non-expiring API tokens scoped to writing DailyMetrics.

Access tokens live 15 minutes and refresh tokens rotate — revoking the old one on use. An automation that loses network between "old token revoked" and "new token persisted" is locked out permanently and silently, and iOS Shortcuts has no durable place to keep a rotating secret. So the session flow cannot serve automations.

A token must not be able to read entries, change a password, or delete data. Scope is enforced at the extractor, not per handler, so a new endpoint cannot accidentally become token-accessible by omission.

Because these never expire, listing and revoking them is required surface, not optional polish. The token value is shown once at mint time and stored hashed.

Acceptance criteria

User can mint a named token from settings; the value is displayed once and never retrievable again
Tokens are stored hashed, never in recoverable form
A token authenticates metric writes and is rejected everywhere else, enforced centrally
User can list tokens with their names and creation dates, and revoke any of them
A revoked token stops working immediately
Session tokens continue to work unchanged for the SPA

Blocked by

None - can start immediately.

## What to build Implements ADR 0003. Users mint named, revocable, non-expiring API tokens scoped to writing `DailyMetric`s. Access tokens live 15 minutes and refresh tokens rotate — revoking the old one on use. An automation that loses network between "old token revoked" and "new token persisted" is locked out permanently and silently, and iOS Shortcuts has no durable place to keep a rotating secret. So the session flow cannot serve automations. A token must not be able to read entries, change a password, or delete data. Scope is enforced at the extractor, not per handler, so a new endpoint cannot accidentally become token-accessible by omission. Because these never expire, listing and revoking them is required surface, not optional polish. The token value is shown once at mint time and stored hashed. ## Acceptance criteria - [ ] User can mint a named token from settings; the value is displayed once and never retrievable again - [ ] Tokens are stored hashed, never in recoverable form - [ ] A token authenticates metric writes and is rejected everywhere else, enforced centrally - [ ] User can list tokens with their names and creation dates, and revoke any of them - [ ] A revoked token stops working immediately - [ ] Session tokens continue to work unchanged for the SPA ## Blocked by None - can start immediately.

GKaszewski added the ready-for-agent label 2026-08-26 09:13:01 +00:00

GKaszewski referenced this issue

2026-08-26 09:14:42 +00:00

Health import endpoint with a durable rejection trace #13

GKaszewski closed this issue

2026-08-26 19:05:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GKaszewski/k-mood#3