coldbox-security-api-authentication

What problem does it solve?

Protects ColdBox REST endpoints from unauthorized access by providing a standardized, auditable API key lifecycle including generation, secure storage, validation, caching, scope enforcement, and revocation.

Core Features & Use Cases

• Key Generation & One-Time Reveal: Create human-readable prefixes and raw keys that are only shown once at generation time.
• Secure Storage & Validation: Hash keys with SHA-256 before storage and validate incoming Bearer tokens against hashed values.
• Performance via Caching: Cache validated key lookups with CacheBox to reduce database load and clear caches on revocation.
• Interceptor Enforcement & Scopes: Enforce keys on /api/ routes with an interceptor, support scope checks per endpoint, and provide management endpoints for listing, generating, and revoking keys.
• Operational Safety: Update last-used timestamps, log unauthorized attempts, and recommend HTTPS in production.

Quick Start

Generate a new API key for a user, install the APIKeyInterceptor in your interceptors configuration, and use the provided service methods to validate and revoke keys.