Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

API Key authentication should allow scopes to be defined.

See original GitHub issue

Today the scopes field on a security definition is only allowed on type=oauth What is the reason to not allow scopes to be defined at an api key level?

For a good example of APIs that allow auth tokens to have scopes see GitHub’s personal access tokens (https://github.com/settings/tokens/new)

Why can’t I define an API and describe what scopes each endpoint needs/allows?

Issue Analytics

State:
Created 6 years ago
Reactions:24
Comments:8 (5 by maintainers)

Top GitHub Comments

12reactions

darrelmillercommented, Nov 3, 2017

I don’t see any reason why it couldn’t be added to api key also. /cc @OAI/tdc

7reactions

avanbrunt-cbcommented, Jun 24, 2019

@MikeRalphson Just wanted to check in on the status of roles/scopes being added to non-OAuth security schemas. I see in the PR you referenced above the roles/scopes change was omitted https://github.com/OAI/OpenAPI-Specification/pull/1764#issuecomment-460964363

However in the big list of possibilities for 3.1, I see that the scopes on non-OAuth security schemes is checked off. Here is the PR for the change https://github.com/OAI/OpenAPI-Specification/pull/1829

Does this mean that the concept is approved for 3.1 but just needs refinement or is it potentially on the chopping block?