[Feature] Restrict API Key by host/ip

[david-thaler]

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.

• Yes

The feature

Incase this is a duplicate I'm apologise ahead of time, I couldn't find it myself.

I believe it would be a good idea to be able to restrict an API keys usage by host/ip or even some other filters (if others can come up with any further ideas). Some tools I've found (for example tiktok remover) have resorted to suggesting the api key to be used should be just "all permissions" because of recent "permission changes". My concern with this is that obviously an api key can be used by anyone so if the key becomes compromised it's now usable by an attacker. If we are able to restrict the api key usage giving all permissions it would at least add a bit more security to this tools that don't give us the support required to fully understand the permissions needed and to avoid the trial and error hell of guessing the permissions required.

Platform

• Server
• Web
• Mobile

[bo0tzz]

I'm unsure about this, I don't think restricting requests by origin is really Immich's job - it would be better handled at the reverse proxy level or such.
I also don't think that tools suggesting you just give them a full access key means that restricting origin is the solution - the fix there IMO is for those tools to figure out what set of permissions they actually need so keys can be properly permission-limited.