API key management — production auth for admin and public endpoints

[leocagli]

Problem

All API routes are currently unprotected. There is no authentication for the admin console or the public API. This blocks production use.

Design

Admin key (full access)

Generated on first boot, stored as ADMIN_API_KEY env var.
Required on: all /admin/* routes, /api/agents write operations.

Service keys (scoped)

Created by admin via:

POST /api/admin/keys
{
  "name": "my-integration",
  "scopes": ["x402:quote", "x402:settle", "agents:read"],
  "expiresAt": "2027-01-01"
}

Returns: { key: "osk_live_abc...", id: "key_123" }

Request auth

Authorization: Bearer osk_live_abc...

Or for simple integrations: ?apiKey=osk_live_abc...

Rate limits

Tier	Requests/min
No key	10
Free	60
Pro	600
Admin	unlimited

Rate limits enforced via Vercel KV (sliding window counter).

Admin UI

• Keys management page in admin console
• Show: name, scopes, last used, request count, status
• Revoke / rotate buttons

Files to create

• lib/auth/api-keys.ts — key generation, validation, rate limiting
• lib/auth/middleware.ts — Next.js middleware for route protection
• middleware.ts — root middleware applying auth
• app/admin/keys/page.tsx

🎁 Evidencia visual = reward extra

• Si tu PR incluye video demo o capturas de pantalla mostrando la funcionalidad pedida funcionando end-to-end, va a ser considerado para rewards de GrantFox en esta issue. No es obligatorio, pero suma mucho para la evaluación.

[gloskull]

Hi, I’d love to work on this issue. I have 4 years of experience across backend, frontend, full-stack, and smart contract development. I understand the task clearly and can deliver a clean, efficient, well-tested solution on time, with strong focus on code quality and maintainability. My PR will be submitted in under 10 hours.

[MztaKing]

Dear Team, I would appreciate the opportunity to work on this issue.
Kind Regards

[raz-byte]

Hi team,
​I would love to take on this issue and implement the production-ready API key management and authentication system for Open-Stellar. I have strong experience building secure API architectures, working with Next.js middleware, and managing granular API access control.
​How I Plan to Implement This:
​
API Key Architecture (lib/auth/api-keys.ts): I will implement the generation and cryptographic validation of scoped service keys (using the osk_live_... prefix) alongside the standard ADMIN_API_KEY environment variable check.
​Middleware Protection (middleware.ts & lib/auth/middleware.ts): I will set up the Next.js middleware layer to intercept incoming requests, accurately parse headers for Bearer tokens and fallback query parameters, and enforce strict route-level protection based on key scopes.
​
Rate Limiting with Vercel KV: I will integrate a robust, sliding-window rate limiter using Vercel KV, ensuring strict enforcement of your defined tiers: No key, Free, Pro, and Admin.
​Admin Keys UI (app/admin/keys/page.tsx): I will build an intuitive, clean management dashboard allowing admins to generate new keys, assign specific scopes, monitor key usage stats, and instantly revoke or rotate keys.

​Deliverables:
​I will deliver clean, type-safe code that aligns with your repository's patterns. Along with the pull request, I will provide a comprehensive video walkthrough demonstrating:
​Creating scoped keys in the Admin UI.
​Successful authenticated requests using the generated keys.
​Automated rate-limit blocking when limits are exceeded.
​Seamless key revocation and instant access denial.
​I am ready to get started on this immediately and look forward to contributing to Open-Stellar!
​Best regards,
Abdulrazaq

[OmniZlatoon]

Good day sir, Ready to deliver the task A.S.A.P. Gone through the issue and to be honest, i can work the task with the right tools at hand. please assign me maintainer . My eta is 5 hours

[github-actions]

✅ Accepted — @OmniZlatoon, this issue is yours. Please open a PR that references #39. Comment /unassign to release it.