Skip to content

MVP access control: shared key (?key=) + rotation #8

Open
Open
MVP access control: shared key (?key=) + rotation#8
Labels
area:backendBackend servicearea:securityAccess control / abuse preventionepicEpic (parent issue)mvpMVP scopepriority:p0Must-have for MVP

Description

@BleedingDev
BleedingDev
opened on Dec 28, 2025

Goal

Add minimal protection for the hosted MVP so random third parties can’t freely use the API from the browser.

Who Uses This

  • Operators: avoids obvious abuse and protects upstream quotas.
  • E-shops: more stable service.

What “Done” Means (Business)

  • Requests must include a shared key (?key=) to use /suggest (demo phase).
  • Keys can be rotated without downtime.
  • Error messaging is clear when missing/invalid.

Constraints

  • MVP-simple: query param auth is acceptable.
  • We accept that keys can be extracted from browser code; goal is to reduce drive-by abuse.

Out of Scope

  • Full user accounts, OAuth, per-tenant billing.
  • Strong client-bound secrets.

MVP Breakdown

Activity

  1. BleedingDev
    added
    epicEpic (parent issue)
    mvpMVP scope
    priority:p0Must-have for MVP
    area:backendBackend service
    area:securityAccess control / abuse prevention
    on Dec 28, 2025

  2. coderabbitai commented on Dec 28, 2025

    @coderabbitai
    coderabbitaibot
    on Dec 28, 2025 – with coderabbitai

    📝 CodeRabbit Plan Mode

    Generate an implementation plan and prompts that you can use with your favorite coding agent.

    • Create Plan
    Examples
    🔗 Similar Issues

    Possible Duplicates

    👤 Suggested Assignees
    🧪 Issue enrichment is currently in open beta.

    You can configure auto-planning by selecting labels in the issue_enrichment configuration.

    To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

    issue_enrichment:
  auto_enrich:
    enabled: false

    💬 Have feedback or questions? Drop into our discord!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:backendBackend servicearea:securityAccess control / abuse preventionepicEpic (parent issue)mvpMVP scopepriority:p0Must-have for MVP

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions