officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prettier: mobile-api-keys tables

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-08 10:44:54 +00:00
co-authored by Claude Opus 5
parent 555da9a170
commit 8987898dd7
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/mobile-api-keys.md
+13 -9
View File
@@ -79,11 +79,11 @@ answer.
Identical to the JWT in all three places:
| Where | How |
|---|---|
| Normal requests | `Authorization: Bearer ofk_…` |
| Media URLs (`<Image>`, `<Video>`, file `/raw`) | `?token=ofk_…` — URL-encode it |
| WebSockets | `?token=ofk_…` on the upgrade URL |
| Where | How |
| ---------------------------------------------- | --------------------------------- |
| Normal requests | `Authorization: Bearer ofk_…` |
| Media URLs (`<Image>`, `<Video>`, file `/raw`) | `?token=ofk_…` — URL-encode it |
| WebSockets | `?token=ofk_…` on the upgrade URL |
The `?token=` fallback is accepted on **every** protected `/api` route, not just media. That is
pre-existing behaviour and not something to rely on: it puts the credential in URLs, which reach proxy
@@ -125,9 +125,9 @@ will not meet it.
**401 and 403 mean different things and must be handled differently.**
| Status | Meaning | What the app should do |
|---|---|---|
| **401** | The credential is dead — revoked, expired, or never valid. | Clear it, send the user to the login screen. |
| Status | Meaning | What the app should do |
| ------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| **401** | The credential is dead — revoked, expired, or never valid. | Clear it, send the user to the login screen. |
| **403** | The credential is **fine**; this account may not reach this feature. | **Do not clear the credential.** Show "not available for your account" and stay signed in. |
Clearing a good key on a 403 is the failure mode to avoid: it turns a member's missing capability into a
@@ -185,7 +185,11 @@ id; there is no request shape that reaches another account's keys.
### `GET /api/api-keys`
```jsonc
{ "keys": [ /* entry objects as above, newest first — never the key itself */ ] }
{
"keys": [
/* entry objects as above, newest first — never the key itself */
],
}
```
`lastUsedAt` is debounced to at most one write a minute, so it can lag by up to 60 seconds. It is a