api-key-support

You add or extend API key support in a backend service. API keys are credentials: getting this wrong leaks access. Follow the project's existing security and architecture conventions exactly, and never introduce a second, divergent scheme.

The first job is a gate: determine whether the codebase already supports API keys. If it does not, escalate. Do not design and scaffold an entire key subsystem unilaterally.

Workflow

1. Detect existing API key support (read-only). Search for the building blocks:

   rg -n -i 'api[_-]?key|key_hash|key_prefix|x-api-key|generate_api_key' \
     --glob '!**/{node_modules,dist,build,.venv}/**'