feat!: new api key system by ThibaudDauce · Pull Request #3636 · opendatateam/udata

ThibaudDauce · 2026-01-28T07:02:58Z

Replace the single User.apikey (JWS token stored on the user document) with a dedicated ApiToken collection supporting multiple tokens per user, HMAC-SHA256 hashed storage, revocation, expiration, and tracking
New API endpoints: POST /api/1/me/tokens/ (create), GET /api/1/me/tokens/ (list active), DELETE /api/1/me/tokens// (revoke) — the plaintext token is returned only once at creation
Remove the apikey field from the User model and the me_fields / apikey_fields API serializers, along with the old /me/apikey/ endpoint
Add an idempotent migration that hashes existing JWS apikeys with HMAC-SHA256 into the new api_token collection, preserving backward compatibility for existing consumers
Introduce API_TOKEN_SECRET and API_TOKEN_PREFIX settings for token hashing and secret-scanning tool integration

nicolaskempf57

Thanks for this PR ! I think we are ready on udata side, but it will require some changes in cdata and maybe other projects like front-kit if they also have an interface for the api key

ThibaudDauce · 2026-02-25T13:56:38Z

Thanks for this PR ! I think we are ready on udata side, but it will require some changes in cdata and maybe other projects like front-kit if they also have an interface for the api key

Done in datagouv/cdata#962

maudetes

🎉 I think it will be a very nice improvement for security and usability !

maudetes · 2026-02-26T10:56:07Z

+@me.route("/tokens/", endpoint="my_tokens")
+class TokenListAPI(API):


Can we use the wording api key instead of vague token?
In my understanding, other potential token usage would have distinct routes anyway?

I used api_token instead of just token. As discussed I prefer to keep one code for all the tokens since it's the same technical thing with the same operations on it.

# Conflicts: # udata/core/user/models.py # udata/tests/api/test_me_api.py

maudetes · 2026-03-23T08:29:51Z

+        from udata.core.api_token.models import ApiToken
+
+        ApiToken.objects(user=self, revoked_at=None).update(
+            set__revoked_at=datetime.now(timezone.utc)
+        )


Should we delete api keys in the case of a user deletion?

I think revoking is safer to not loose the keys if the user is restored?

Hmm we don't have user restoration. They need to recreate an account if they want to come back

I was thinking of a wrong deletion, for exemple Geoffrey miss click :-)

ahah even if Geoffrey double-miss clicks, I would recommend recreating an account and contacting us, if needed, to get back any old dataset & co

Following the merge of opendatateam/udata#3636 (just because it's faster to merge this than #962)

- Require opendatateam/udata#3636 <img width="2090" height="179" alt="image" src="https://github.com/user-attachments/assets/adb9240d-456f-4476-a0de-89fc4f620f17" /> <img width="1248" height="459" alt="image" src="https://github.com/user-attachments/assets/3ef4f09c-61da-4f53-a9bb-da422359115b" /> <img width="2095" height="329" alt="image" src="https://github.com/user-attachments/assets/2b943ad2-084a-402e-b4dd-0b8174c9b6cf" /> <img width="2092" height="418" alt="image" src="https://github.com/user-attachments/assets/8595708e-1c9f-40db-9e8f-200fe48260ec" /> <img width="902" height="325" alt="image" src="https://github.com/user-attachments/assets/2e872621-e0db-47ba-9de9-1fc5fbe9c3b2" />

ThibaudDauce added 7 commits January 28, 2026 08:02

feat: new api key system

277fe16

Use hmac instead of simple hash

9a13849

review tweaks

1f49450

fix wrong default scope

8968e62

improve doc

ad40ed0

improve doc

cb8f41e

switch datetime.utcnow() and simplify one function

63ca7f8

ThibaudDauce marked this pull request as ready for review February 5, 2026 12:41

ThibaudDauce requested review from maudetes and nicolaskempf57 and removed request for maudetes February 5, 2026 12:41

nicolaskempf57 reviewed Feb 19, 2026

View reviewed changes

Comment thread udata/core/user/api.py Outdated

nicolaskempf57 reviewed Feb 19, 2026

View reviewed changes

Comment thread udata/tests/api/__init__.py Outdated

nicolaskempf57 reviewed Feb 19, 2026

View reviewed changes

Comment thread udata/api/__init__.py

nicolaskempf57 reviewed Feb 19, 2026

View reviewed changes

ThibaudDauce added 2 commits February 25, 2026 14:39

Merge branch 'main' into new_api_key_system

0d6ce03

add prefix into token preview

ed62f80

ThibaudDauce mentioned this pull request Feb 25, 2026

feat: new API keys datagouv/cdata#962

Merged

ThibaudDauce added 2 commits February 25, 2026 14:58

fix review

ee8dcb3

fix small problem in migration

a0b0abc

maudetes reviewed Feb 26, 2026

View reviewed changes

ThibaudDauce added 7 commits March 3, 2026 16:26

fix some review problems

a6033b5

rename controllers and clean doc

185fc6c

apply review comments

386b4a6

check secret_key too

55b366a

move to api_token folder

5b42933

use api token everywhere

a1ac895

Merge remote-tracking branch 'origin/main' into new_api_key_system

9051f38

# Conflicts: # udata/core/user/models.py # udata/tests/api/test_me_api.py

maudetes approved these changes Mar 23, 2026

View reviewed changes

ThibaudDauce added 5 commits March 23, 2026 10:40

small tweaks

8a81647

Merge branch 'main' into new_api_key_system

d1c8c23

fix ci

d2bde5b

switch to scopes list

e58de69

add config in CI

d2edafe

ThibaudDauce force-pushed the new_api_key_system branch from ee48150 to d2edafe Compare March 23, 2026 10:16

ThibaudDauce merged commit 8bfbcc8 into main Mar 23, 2026
1 check passed

ThibaudDauce deleted the new_api_key_system branch March 23, 2026 10:36

ThibaudDauce mentioned this pull request Mar 23, 2026

feat: add missing config for new api keys datagouv/cdata#1006

Merged

ThibaudDauce added a commit to datagouv/cdata that referenced this pull request Mar 23, 2026

feat: add missing config for new api keys (#1006)

fe92b54

Following the merge of opendatateam/udata#3636 (just because it's faster to merge this than #962)

maudetes added this to 🚀 Produit data.gouv.fr Mar 24, 2026

maudetes moved this to ✅ Done in 🚀 Produit data.gouv.fr Mar 24, 2026

		@me.route("/tokens/", endpoint="my_tokens")
		class TokenListAPI(API):

Conversation

ThibaudDauce commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nicolaskempf57 left a comment

Choose a reason for hiding this comment

Uh oh!

ThibaudDauce commented Feb 25, 2026

Uh oh!

maudetes left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

maudetes Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

ThibaudDauce Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

maudetes Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

ThibaudDauce Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

maudetes Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

ThibaudDauce Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

maudetes Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ThibaudDauce commented Jan 28, 2026 •

edited

Loading