Correct API Key Generation and Usage on Cloud

I'm getting a 401 when trying to create a key via API on Cloud. Is the "keys:create" the correct API Key permission?

Yes that's correct. The key that you are using to create this key has key:create permission but it does not work?

Oh no, I mean. I have a key already (with keys:create ) and I'm trying to make user scoped keys.

Sorry typo there, it must be keys

Gotcha. I have a (backend) key like this:

{
  "description": "API key",
  "actions": [
    "documents:import",
    "keys:create"
  ],
  "collections": [
    "*"
  ]
}

And I'd like to use CURL to make more keys like this for each user to use during their session:

{
  "description": "Search key per user",
  "actions": [ "documents:search" ],
  "collections": [
    // Some collections here
  ]
}

Yes, that's valid. I will have to check why it's not working. I will get back to you later today/tomorrow after checking.

Roger that, no problem at all. Would it help if I provided cluster ?

I don't think it will be a cluster specific issue. Let me first see if I can reproduce and then will ask for further details if needed.

Kishore Nallan did you happen to get a chance to look at this?

I just tried this on 0.23.1 and it works for me:

% curl '' \
    -X POST \
    -H "X-TYPESENSE-API-KEY: abcd" \
    -H 'Content-Type: application/json' \
    -d '{"description": "", "value": "foobar","actions": ["keys:create"], "collections": ["*"]}'
{"actions":["keys:create"],"collections":["*"],"description":"","expires_at":64723363199,"id":0,"value":"foobar"}%

% curl '' \
    -X POST \
    -H "X-TYPESENSE-API-KEY: foobar" \
    -H 'Content-Type: application/json' \
    -d '{"description": "", "value": "amazing","actions": ["documents:search"], "collections": ["*"]}'
{"actions":["documents:search"],"collections":["*"],"description":"","expires_at":64723363199,"id":1,"value":"amazing"}%

Does the second call, use the API key generated in the first call?

Yes, see the use of foobar in the X-TYPESENSE-API-KEY header

Wait, wild. So does "value": "foobar" mean the API key generated will be foobar rather than auto generated?

Yes, correct.

So I'm still getting a 401 on my side.

I've got a key like this:

{
  "description": "Admin key",
  "actions": [ "documents:import", "keys:create" ]
  "collections": [
    "*"
  ]
}

That I created via UI. I then took that API and tried to create more like this using HTTP. Heres the body:

{
   "description":"Search key for user ykDG6Un4oNUs1UBxKqS5ae9HC9D3",
   "actions":[
      "documents:search"
   ],
   "collections":[
      "exercises",
      "programs",
      "programs"
   ]
}

But I get a 401 response.

401 Unauthorized from POST https://xxxxxxx.a1.typesense.net/keys

Hmm, are you also using curl?

I'm using Java HTTP client:

()
                .uri("https://xxxxxxx.a1.typesense.net/keys")
                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
                .header("TYPESENSE-API-KEY", "xxxxxx")
                .body(BodyInserters.fromValue(new TypeSenseGenerateKeyRequest(
                        "Search key for user %s".formatted(userId),
                        Collections.singletonList("documents:search"),
                        List.of(EXERCISES_COLLECTION_NAME,
                                PROGRAMS_COLLECTION_NAME,
                                HISTORY_COLLECTION_NAME))))
                .retrieve()
                .bodyToMono(TypeSenseGenerateKeyResponse.class)
                .block()

Can you quickly try using the curl example I have above to see if it makes a difference? That will tell us where the issue is.

ohh worked straight away. Good eyes Kishore Nallan!

You mean baking a "filter_by" clause into that key? For that you need to use scoped api key. Official clients have a helper that hmacs the filter string and adds the digest as part of the key so that it cannot be tampered.

Ah I see, so this is not something we can do over HTTP only?

I don't follow you. Is there something that you want to do that cannot be done via scoped API keys?

I'd definitely like to use scoped keys, ideally created over HTTP.

Right now I can create keys for our users, but they are not scoped.