Skip to main content

Enable Granular Access Control via Multiple Scoped API Keys

Suggest a Feature

As a developer integrating Reusely with third-party tools, I want to be able to generate unique API keys with limited scopes (permissions), So that I can limit the security blast radius if a specific key is exposed or a third-party service is compromised.


(The equivalent to User Permissions but for API Access)

Acceptance Criteria / Desired Functionality:

  • User can create more than one Public API Key or Secret Key.

  • User can name/label keys for easy identification.

  • User can assign specific scopes to a key (e.g., Read Only, Write Only, Full Access).

  • User can revoke a specific key without rotating the global account secret.

Impact: High. The current single-key implementation blocks us from using Reusely in secure environments where the Principle of Least Privilege is a requirement.

2 comments

Log in to comment and vote

Comments2

  • Purple Quesadilla

    •

    Feb 3

    Another aspect, when users use the "Bank Transfer" payout method (non-tremendous)

    If the secret key is exposed, a user could do a API pull to simply grab Routing and Account Numbers right from the Docs page... (the best built API tool)

    - Side Note: It might be beneficial to disable the live testing within the API Doc’s unless a user is logged in with an active Reusely subscription.

  • Fuchsia Eagle

    •

    Jan 29

    @Rakha Andhika similar to what Klaviyo is doing.