Flask Authentication and API Key System

A simple yet robust Flask application demonstrating user authentication with JWT and a complete API key management system.

Features

• User Authentication: Secure user signup and login using email and password.
• JWT Support: Authenticated routes are protected using JSON Web Tokens (JWT).
• API Key Management:
  • Create named API keys with custom expiration dates.
  • List all active and revoked API keys for a user.
  • Revoke API keys.
• Flexible Authentication Middleware:
  • Protect routes requiring user login (JWT).
  • Protect routes requiring service access (API Key).
  • Protect routes that accept either JWT or API Key.
• Database: Uses Flask-SQLAlchemy with a simple SQLite setup by default.

Prerequisites

• Python 3.x
• pip

Installation

1. Clone the repository (if applicable).
2. Install the required Python packages:

   pip install -r requirements.txt

Configuration

The application can be configured via environment variables. Create a .env file or set them in your shell.

• SECRET_KEY: A strong, secret key for signing JWTs and other security functions.
• DATABASE_URL: The connection URI for the database. Defaults to a local SQLite database (sqlite:///auth.db).

See config.py for more details.

Running the Application

1. Ensure your database is set up. The application will create the auth.db file on first run if using the default SQLite configuration.
2. Run the Flask development server:

   python app.py

   The server will start on http://127.0.0.1:5000.

API Endpoints

The base URL is http://127.0.0.1:5000.

Authentication

1. User Signup

• Endpoint: POST /auth/signup
• Description: Creates a new user account.
• Request Body:

  {
    "email": "user@example.com",
    "password": "a-strong-password"
  }

• Success Response (201):

  {
    "message": "User created successfully",
    "user_id": 1
  }

2. User Login

• Endpoint: POST /auth/login
• Description: Authenticates a user and returns a JWT.
• Request Body:

  {
    "email": "user@example.com",
    "password": "a-strong-password"
  }

• Success Response (200):

  {
    "token": "your.jwt.token",
    "user_id": 1
  }

API Key Management (Requires JWT Authentication)

All endpoints in this section require an Authorization: Bearer <jwt_token> header.

1. Create API Key

• Endpoint: POST /keys/create
• Description: Generates a new API key for the authenticated user.
• Request Body (optional):

  {
    "name": "My Production Key",
    "expires_in_days": 90
  }

• Success Response (201):

  {
    "api_key": "the-generated-api-key",
    "key_id": 1,
    "expires_at": "2025-03-06T12:00:00.000000Z"
  }

2. List API Keys

• Endpoint: GET /keys/list
• Description: Retrieves all API keys associated with the authenticated user.
• Success Response (200):

  {
    "keys": [
      {
        "id": 1,
        "name": "My Production Key",
        "created_at": "2025-12-06T12:00:00.000000Z",
        "expires_at": "2026-03-06T12:00:00.000000Z",
        "revoked": false
      }
    ]
  }

3. Revoke API Key

• Endpoint: DELETE /keys/revoke/<key_id>
• Description: Revokes an API key, preventing it from being used.
• Success Response (200):

  {
    "message": "API key revoked successfully"
  }

Protected Routes

1. User-Only Route

• Endpoint: GET /api/user-only
• Description: An example route accessible only with a valid JWT.
• Required Header: Authorization: Bearer <jwt_token>
• Success Response (200):

  {
    "message": "User authenticated",
    "user_id": 1,
    "email": "user@example.com"
  }

2. Service-Only Route

• Endpoint: GET /api/service-only
• Description: An example route accessible only with a valid API key.
• Required Header: X-API-Key: <api_key>
• Success Response (200):

  {
    "message": "Service authenticated",
    "key_name": "My Production Key",
    "user_id": 1
  }

3. Mixed Authentication Route

• Endpoint: GET /api/protected
• Description: An example route accessible with either a JWT or an API key.
• Required Header: Authorization: Bearer <jwt_token> OR X-API-Key: <api_key>
• Success Response (200):
  • Via JWT:

    {
      "message": "Accessed via user token",
      "user_id": 1,
      "email": "user@example.com"
    }

  • Via API Key:

    {
      "message": "Accessed via API key",
      "key_name": "My Production Key",
      "user_id": 1
    }