API Key Manager
TsgcWSAPIKeyManager — full-lifecycle management for the API keys your sgcWebSockets servers issue. Generate, hash, validate, rotate, revoke and audit — all from one drop-on-form component.
TsgcWSAPIKeyManager — full-lifecycle management for the API keys your sgcWebSockets servers issue. Generate, hash, validate, rotate, revoke and audit — all from one drop-on-form component.
Plaintext keys are seen exactly once; only the SHA-256/512/Bcrypt hash is stored.
The manager generates cryptographically random keys with a configurable human-readable prefix (e.g. sgc_live_aB3...) so support staff and log scrubbers can spot which environment a leaked key belongs to. Keys are hashed at rest with SHA-256, SHA-512 or Bcrypt, optionally key-stretched with extra iterations, and validated in constant time to thwart timing attacks.
Attach the manager to TsgcWebSocketHTTPServer or TsgcWSServer_HTTPAPI through the APIKeyManager property. Authorize requests by calling IsRequestAuthorized from the server's OnConnect event — the manager extracts the X-API-Key header (or query parameter), validates the key, optionally enforces a required scope and records the IP for audit.
IssueKey(Owner, Scopes, ExpiresInSec) generates a cryptographically random key, hashes it and stores the digest. The plaintext is returned exactly once — deliver it to your customer from the OnKeyIssued event handler. The hash, owner, scopes and metadata persist in storage; the plaintext is never written anywhere.
The server's OnConnect event calls IsRequestAuthorized with the connection's headers, URL and IP. The manager parses the key from the X-API-Key header (or api_key query parameter), rehashes it, performs a constant-time comparison, optionally enforces a required scope and verifies the request IP against the allowlist if configured.
RotateKey(OldKey, NewKey) issues a fresh key for the same owner and scopes and marks the old one as kksRotated. During the configurable grace period (default 24 hours) both keys validate so the customer can swap without downtime. Auto-rotate sweeps keys older than AutoRotateDays, and OnKeyExpired fires NotifyBeforeExpirySec seconds early so you can email the customer in advance.
RevokeKey(Key, Reason) immediately invalidates a key (subscription cancelled, key leaked). The audit log records the revocation, including IP and reason. Subsequent validations return False and OnKeyValidated fires with aValid := False.
Issue a key, attach the manager, then authorize every connection.
// Branded keys
sgcWSAPIKeyManager1.Generation.KeyPrefix := 'sgc_live_';
sgcWSAPIKeyManager1.Generation.KeyLength := 32;
// Encrypted file storage that survives restarts
sgcWSAPIKeyManager1.Storage.StorageType := kstFile;
sgcWSAPIKeyManager1.Storage.FileName := 'apikeys.dat';
sgcWSAPIKeyManager1.Storage.EncryptAtRest := True;
sgcWSAPIKeyManager1.Storage.EncryptionKey := 'master-secret';
// SHA-256 hashing with a static salt
sgcWSAPIKeyManager1.Hashing.Algorithm := khaSHA256;
sgcWSAPIKeyManager1.Hashing.Salt := 'my-salt';
// Scope catalog
sgcWSAPIKeyManager1.Scopes.Enabled := True;
with sgcWSAPIKeyManager1.Scopes.Scopes.Add as TsgcAPIKeyScopeItem do
begin
Name := 'read:orders';
end;
// 90-day default TTL, 24h rotation grace period
sgcWSAPIKeyManager1.Expiration.DefaultTTLSec := 90 * 86400;
sgcWSAPIKeyManager1.Rotation.Enabled := True;
sgcWSAPIKeyManager1.Rotation.GracePeriodSec := 86400;
// Attach to server and load existing keys
sgcWSAPIKeyManager1.LoadFromFile('apikeys.dat');
sgcWebSocketHTTPServer1.APIKeyManager := sgcWSAPIKeyManager1;
// Issue a key (plaintext returned only here)
LKey := sgcWSAPIKeyManager1.IssueKey('customer-123',
TArray<string>.Create('read:orders'), 30 * 86400);
// Authorize every connection in OnConnect
procedure TForm1.ServerConnect(Connection: TsgcWSConnection);
begin
if not sgcWSAPIKeyManager1.IsRequestAuthorized(
Connection.HeadersRequest.Text, Connection.URL,
Connection.IP, 'read:orders') then
Connection.Disconnect;
end;Generate sgc_live_ keys for production and sgc_test_ for staging. Support can spot environment leaks at a glance, and log scrubbers can redact prefixes consistently.
Each customer's key carries scopes (read:orders, write:shipments). Pair with TsgcWSRateLimiter.PerAPIKey for per-tier rate limits read straight from the key store.
12-month audit log retention, IP-stamped entries for every key-lifecycle action, OnAuditEvent for SIEM forwarding. Encrypted at-rest storage protects the key store on disk.
Customer reports a leaked key but their integration is still live. Rotate it: a fresh key is issued; the old one keeps working for 24h while the customer rolls over, then is invalidated automatically.
Deep-link to the component reference, grab the ready-to-run demo project, and download the trial.