mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-08-16 00:01:02 +00:00
n0ctal
1230559e69
* security(api): add scoped expiring API tokens * security(api): make scoped token lifecycle enforceable --------- Co-authored-by: n0ctal <293235942+n0ctal@users.noreply.github.com>
60 lines
3.3 KiB
Plaintext
60 lines
3.3 KiB
Plaintext
---
|
|
title: API Tokens
|
|
description: 'Manage Bearer tokens used for programmatic auth (bots, central
|
|
panels acting on this node, CI). Each token has a unique name and an enabled
|
|
flag — disable to revoke without deleting, delete to revoke permanently.
|
|
Tokens are stored as SHA-256 hashes and the plaintext is returned only once,
|
|
in the create response — it cannot be retrieved afterwards, so copy it then.
|
|
Send one as <code>Authorization: Bearer <token></code> on any
|
|
/panel/api/* request — the token is a full-admin credential.'
|
|
full: true
|
|
_openapi:
|
|
preload:
|
|
- ./public/openapi.json
|
|
toc:
|
|
- depth: 2
|
|
title: List every API token, enabled or not. The token value is never returned —
|
|
only metadata.
|
|
url: '#list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata'
|
|
- depth: 2
|
|
title: Mint a scoped API token. The server-generated plaintext is returned only
|
|
once and stored as a hash.
|
|
url: '#mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash'
|
|
- depth: 2
|
|
title: Permanently delete a token. Any caller using it stops authenticating
|
|
immediately.
|
|
url: '#permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately'
|
|
- depth: 2
|
|
title: Toggle a token enabled/disabled without deleting it. Disabled tokens are
|
|
rejected by checkAPIAuth on the next request.
|
|
url: '#toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request'
|
|
structuredData:
|
|
headings:
|
|
- content: List every API token, enabled or not. The token value is never returned
|
|
— only metadata.
|
|
id: list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata
|
|
- content: Mint a scoped API token. The server-generated plaintext is returned
|
|
only once and stored as a hash.
|
|
id: mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash
|
|
- content: Permanently delete a token. Any caller using it stops authenticating
|
|
immediately.
|
|
id: permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately
|
|
- content: Toggle a token enabled/disabled without deleting it. Disabled tokens
|
|
are rejected by checkAPIAuth on the next request.
|
|
id: toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request
|
|
contents: []
|
|
---
|
|
|
|
{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
|
|
|
|
export default function Layout(props) {
|
|
const { APIPage, OpenAPIPage } = props.components ?? {};
|
|
// "APIPage" is the old name from v10, this allows both for backward compatibility
|
|
const Comp = OpenAPIPage ?? APIPage;
|
|
return (
|
|
<>
|
|
{props.children}
|
|
<Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/panel/api/setting/apiTokens","method":"get"},{"path":"/panel/api/setting/apiTokens/create","method":"post"},{"path":"/panel/api/setting/apiTokens/delete/{id}","method":"post"},{"path":"/panel/api/setting/apiTokens/setEnabled/{id}","method":"post"}]} showTitle />
|
|
</>
|
|
);
|
|
} |