skills.rest
ColdBox
ColdBoxOFFICIAL
Explore all skills by this author →
Website𝕏@coldboxGitHub

coldbox-security-api-authentication

Generate, hash, cache, validate, and revoke API keys for ColdBox REST endpoints.

1|Updated Apr 10, 2026
Search Tags:#api-keys#scopes#api-authentication#interceptor#revocation#cachebox#coldbox
One-click install
npx skills add https://github.com/ColdBox/skills --skill coldbox-security-api-authentication
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coldbox-security-api-authentication
Source: https://github.com/ColdBox/skills/tree/main/security/api-authentication
Command: npx skills add https://github.com/ColdBox/skills --skill coldbox-security-api-authentication

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Protects ColdBox REST endpoints from unauthorized access by providing a standardized, auditable API key lifecycle including generation, secure storage, validation, caching, scope enforcement, and revocation.

Core Features & Use Cases

  • Key Generation & One-Time Reveal: Create human-readable prefixes and raw keys that are only shown once at generation time.
  • Secure Storage & Validation: Hash keys with SHA-256 before storage and validate incoming Bearer tokens against hashed values.
  • Performance via Caching: Cache validated key lookups with CacheBox to reduce database load and clear caches on revocation.
  • Interceptor Enforcement & Scopes: Enforce keys on /api/ routes with an interceptor, support scope checks per endpoint, and provide management endpoints for listing, generating, and revoking keys.
  • Operational Safety: Update last-used timestamps, log unauthorized attempts, and recommend HTTPS in production.

Quick Start

Generate a new API key for a user, install the APIKeyInterceptor in your interceptors configuration, and use the provided service methods to validate and revoke keys.

Frequently Asked Questions about coldbox-security-api-authentication

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure REST API endpoints with scoped API keys in ColdBox?▼

Secure ColdBox REST endpoints by installing an APIKeyInterceptor to validate Bearer tokens against SHA-256 hashed keys and enforce scope-based access on /api/ routes. The interceptor checks cached keys to authorize requests.

What is the best way to generate and revoke API keys for a ColdBox REST API?▼

Use dedicated management endpoints to generate keys with human-readable prefixes and revoke them. Generated raw keys are shown only once, hashed with SHA-256 for storage, and removed from CacheBox upon revocation.

How does API key validation caching work with CacheBox?▼

Validated key lookups are stored in CacheBox with a TTL to reduce database load on subsequent requests. The cache is automatically cleared upon key revocation to prevent unauthorized access.

How do I enforce scope-based access control on my API routes?▼

Configure the API key interceptor to check specific scopes per endpoint. The interceptor validates the Bearer token and verifies the associated key scopes match the required permissions for the targeted /api/ route.

Does ColdBox API authentication support tracking key usage and unauthorized attempts?▼

Yes, operational safety features update last-used timestamps for active keys and log unauthorized access attempts. The system also recommends using HTTPS in production to protect Bearer token transmission.

Related Skills

Explore More Software Engineering Skills→
ColdBoxColdBox

cbsecurity

Secure ColdBox and BoxLang apps with annotation-based access control and JWT authentication.

Official
Advanced
marquesfelipmarquesfelip

api-key-management

Design, rotate, and audit API keys for SaaS applications.

Community
Advanced
ColdBoxColdBox

coldbox-interceptor-development

Register ColdBox interceptors for lifecycle events like preProcess and postProcess.

Official
Intermediate
HeldinhowHeldinhow
4

jwt-auth

Implements JWT authentication for secure API access with signed tokens.

Community
Intermediate