github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

API Keys > Permissions to manage users' keys #979

New Issue
Closed
opened 2026-03-13 08:14:43 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-03-13 08:14:43 -05:00
Owner
Copy Link

Originally created by @rxri on GitHub (Apr 4, 2025).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

No response

Describe the solution you'd like

Desired behavior:
API Key should have its own permissions that you can add to the role or user, integrated with Admin plugin, like api-key:delete, api-key:list etc.
/api-key/list route should have ability to specify user_id as query param or in JSON body and return api key list if user/admin has required permission

Actual behavior:
Only linked user (with their user_id) to the key can remove or list their keys.
api-key/routes/delete-api-key.ts#L50, api-key/routes/list-api-keys.ts#L32
Admin should be able to list and remove them too, without the need of modifying the database directly.

Describe alternatives you've considered

There's none really. I can't do it with API Key plugin because there's no way to modify the route itself.

Additional context

I've already talked about this with @ping-maxwell on discord and they said it is good idea in general so I hope it will be added into API Key plugin

Originally created by @rxri on GitHub (Apr 4, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. _No response_ ### Describe the solution you'd like Desired behavior: [API Key](https://www.better-auth.com/docs/plugins/api-key) should have its own permissions that you can add to the role or user, integrated with [Admin](https://www.better-auth.com/docs/plugins/admin) plugin, like `api-key:delete`, `api-key:list` etc. `/api-key/list` route should have ability to specify `user_id` as query param or in JSON body and return api key list if user/admin has required permission Actual behavior: Only linked user (with their `user_id`) to the key can remove or list their keys. [api-key/routes/delete-api-key.ts#L50](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/src/plugins/api-key/routes/delete-api-key.ts#L50), [api-key/routes/list-api-keys.ts#L32](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/src/plugins/api-key/routes/list-api-keys.ts#L32) Admin should be able to list and remove them too, without the need of modifying the database directly. ### Describe alternatives you've considered There's none really. I can't do it with [API Key](https://www.better-auth.com/docs/plugins/api-key) plugin because there's no way to modify the route itself. ### Additional context I've already talked about this with @ping-maxwell on discord and they said it is good idea in general so I hope it will be added into [API Key](https://www.better-auth.com/docs/plugins/api-key) plugin
GiteaMirror added the enhancement label 2026-03-13 08:14:43 -05:00
GiteaMirror commented 2026-03-13 08:14:47 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Jul 5, 2025):

Hi, @rxri. I'm Dosu, and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale.

Issue Summary

  • Enhancement request for managing API keys with distinct permissions.
  • Proposal includes assigning permissions to roles or users.
  • Admins should be able to list and delete keys without direct database modification.
  • Discussed with a team member on Discord; no further comments or developments.

Next Steps

  • Is this issue still relevant to the latest version of the better-auth repository? If so, please comment to keep the discussion open.
  • If there are no updates, the issue will be automatically closed in 7 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Jul 5, 2025): Hi, @rxri. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale. **Issue Summary** - Enhancement request for managing API keys with distinct permissions. - Proposal includes assigning permissions to roles or users. - Admins should be able to list and delete keys without direct database modification. - Discussed with a team member on Discord; no further comments or developments. **Next Steps** - Is this issue still relevant to the latest version of the better-auth repository? If so, please comment to keep the discussion open. - If there are no updates, the issue will be automatically closed in 7 days. Thank you for your understanding and contribution!
GiteaMirror commented 2026-03-13 08:14:48 -05:00
Author
Owner
Copy Link

@rxri commented on GitHub (Jul 5, 2025):

It is still relevant.

@rxri commented on GitHub (Jul 5, 2025): It is still relevant.
GiteaMirror commented 2026-03-13 08:14:49 -05:00
Author
Owner
Copy Link

@rxri commented on GitHub (Aug 12, 2025):

Why was this closed? This wasn't added to the newest release or repo

@rxri commented on GitHub (Aug 12, 2025): Why was this closed? This wasn't added to the newest release or repo
GiteaMirror commented 2026-03-13 08:14:49 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Nov 11, 2025):

Hi, @rxri. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested adding granular permissions like api-key:delete and api-key:list for managing API keys via the Admin plugin.
  • This would allow admins to manage users' API keys without direct database edits.
  • The issue was previously marked as stale due to inactivity, but you confirmed it was still relevant.
  • Despite your confirmation, the issue was closed without resolution or inclusion in recent releases.

Next Steps:

  • Please let me know if this feature request is still relevant to the latest version of better-auth by commenting on this issue.
  • If I do not hear back within 7 days, I will automatically close the issue.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Nov 11, 2025): Hi, @rxri. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested adding granular permissions like `api-key:delete` and `api-key:list` for managing API keys via the Admin plugin. - This would allow admins to manage users' API keys without direct database edits. - The issue was previously marked as stale due to inactivity, but you confirmed it was still relevant. - Despite your confirmation, the issue was closed without resolution or inclusion in recent releases. **Next Steps:** - Please let me know if this feature request is still relevant to the latest version of better-auth by commenting on this issue. - If I do not hear back within 7 days, I will automatically close the issue. Thank you for your understanding and contribution!
GiteaMirror commented 2026-03-13 08:14:49 -05:00
Author
Owner
Copy Link

@rxri commented on GitHub (Nov 11, 2025):

still relevant.

@rxri commented on GitHub (Nov 11, 2025): still relevant.
GiteaMirror commented 2026-03-13 08:14:50 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Feb 10, 2026):

Hi, @rxri. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested granular API key management permissions integrated with the Admin plugin, such as api-key:delete and api-key:list.
  • This would allow admins to manage users' API keys via the API without needing direct database access.
  • The issue has been marked as stale multiple times, with you confirming it remains relevant.
  • Despite ongoing interest, there has been no implementation or updates, and the issue was closed without resolution or inclusion in recent releases.

Next Steps:

  • Please let me know if this feature is still relevant to the latest version of better-auth by commenting on this issue.
  • If I do not hear back within 7 days, the issue will be automatically closed.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Feb 10, 2026): Hi, @rxri. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested granular API key management permissions integrated with the Admin plugin, such as `api-key:delete` and `api-key:list`. - This would allow admins to manage users' API keys via the API without needing direct database access. - The issue has been marked as stale multiple times, with you confirming it remains relevant. - Despite ongoing interest, there has been no implementation or updates, and the issue was closed without resolution or inclusion in recent releases. **Next Steps:** - Please let me know if this feature is still relevant to the latest version of better-auth by commenting on this issue. - If I do not hear back within 7 days, the issue will be automatically closed. Thank you for your understanding and contribution!
GiteaMirror commented 2026-03-13 08:14:50 -05:00
Author
Owner
Copy Link

@rxri commented on GitHub (Feb 10, 2026):

Still relevant

@rxri commented on GitHub (Feb 10, 2026): Still relevant
GiteaMirror commented 2026-03-13 08:14:50 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Feb 11, 2026):

Hey @rxri! This is a might old issue now 😭

We haven't solved the problem of plugin integrations with each other, which is why this issue still exists :/

We're moving feature requests to the discussions section to keep issues section as issues only, I've gone ahead and copied it over:
https://github.com/better-auth/better-auth/discussions/7907

@ping-maxwell commented on GitHub (Feb 11, 2026): Hey @rxri! This is a might old issue now 😭 We haven't solved the problem of plugin integrations with each other, which is why this issue still exists :/ We're moving feature requests to the discussions section to keep issues section as issues only, I've gone ahead and copied it over: https://github.com/better-auth/better-auth/discussions/7907
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#979
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?