feat(api): gate access token issuance behind feature flag

packages/api/internal/handlers/accesstoken.go

@@ -11,6 +11,7 @@ import (
 	"github.com/e2b-dev/infra/packages/auth/pkg/auth"
 	authqueries "github.com/e2b-dev/infra/packages/db/pkg/auth/queries"
 	"github.com/e2b-dev/infra/packages/db/pkg/dberrors"
+	"github.com/e2b-dev/infra/packages/shared/pkg/featureflags"
 	"github.com/e2b-dev/infra/packages/shared/pkg/ginutils"
 	"github.com/e2b-dev/infra/packages/shared/pkg/keys"
 	"github.com/e2b-dev/infra/packages/shared/pkg/telemetry"
@@ -21,6 +22,12 @@ func (a *APIStore) PostAccessTokens(c *gin.Context) {
 
 	userID := auth.MustGetUserID(c)
 
+	if a.featureFlags.BoolFlag(ctx, featureflags.DisableAccessTokenIssuanceFlag, featureflags.UserContext(userID.String())) {
+		a.sendAPIStoreError(c, http.StatusGone, "Creating new access tokens is disabled. E2B_ACCESS_TOKEN is deprecated; use an API key (E2B_API_KEY) instead. See https://e2b.dev/docs/migration/access-token-deprecation")
+
+		return
+	}
+
 	body, err := ginutils.ParseBody[api.NewAccessToken](ctx, c)
 	if err != nil {
 		a.sendAPIStoreError(c, http.StatusBadRequest, fmt.Sprintf("Error when parsing request: %s", err))

packages/api/internal/handlers/accesstoken_test.go

@@ -0,0 +1,38 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/launchdarkly/go-server-sdk/v7/testhelpers/ldtestdata"
+	"github.com/stretchr/testify/require"
+
+	sharedauth "github.com/e2b-dev/infra/packages/auth/pkg/auth"
+	"github.com/e2b-dev/infra/packages/shared/pkg/featureflags"
+)
+
+func TestPostAccessTokensRejectsWhenIssuanceDisabled(t *testing.T) {
+	t.Parallel()
+
+	td := ldtestdata.DataSource()
+	td.Update(td.Flag(featureflags.DisableAccessTokenIssuanceFlag.Key()).VariationForAll(true))
+	ff, err := featureflags.NewClientWithDatasource(td)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ff.Close(t.Context()) })
+
+	recorder := httptest.NewRecorder()
+	ginCtx, _ := gin.CreateTestContext(recorder)
+	ginCtx.Request = httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/access-tokens", strings.NewReader(`{"name":"my token"}`))
+	ginCtx.Request.Header.Set("Content-Type", "application/json")
+	sharedauth.SetUserIDForTest(t, ginCtx, uuid.New())
+
+	store := &APIStore{featureFlags: ff}
+	store.PostAccessTokens(ginCtx)
+
+	require.Equal(t, http.StatusGone, recorder.Code)
+	require.Contains(t, recorder.Body.String(), "E2B_API_KEY")
+}

packages/shared/pkg/featureflags/flags.go

@@ -219,6 +219,12 @@ var (
 	// from the in-progress snapshot pull, so pinning the retry to it avoids
 	// re-pulling the snapshot onto yet another node.
 	ResumeOriginNodeRemapFlag = NewBoolFlag("resume-origin-node-remap", false)
+
+	// DisableAccessTokenIssuanceFlag stops POST /access-tokens from issuing new
+	// E2B access tokens (sk_e2b_) once enabled. E2B_ACCESS_TOKEN is deprecated in
+	// favor of E2B_API_KEY; the CLI now authenticates via Hydra JWTs. Off by
+	// default so issuance keeps working until the deprecation cutover.
+	DisableAccessTokenIssuanceFlag = NewBoolFlag("disable-access-token-issuance", false)
 )
 
 // envdTimeoutFallbackMs reads ENVD_TIMEOUT (Go duration string, e.g. "10s")

spec/openapi.yml

@@ -150,6 +150,12 @@ components:
         application/json:
           schema:
             $ref: "#/components/schemas/Error"
+    "410":
+      description: Gone
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/Error"
     "500":
       description: Server error
       content:
@@ -3536,7 +3542,8 @@ paths:
   /access-tokens:
     post:
       summary: Create access token
-      description: Create a new access token
+      description: Create a new access token. Deprecated; use an API key (E2B_API_KEY) instead.
+      deprecated: true
       tags: [access-tokens]
       security:
         - AuthProviderBearerAuth: []
@@ -3555,6 +3562,8 @@ paths:
                 $ref: "#/components/schemas/CreatedAccessToken"
         "401":
           $ref: "#/components/responses/401"
+        "410":
+          $ref: "#/components/responses/410"
         "500":
           $ref: "#/components/responses/500"