How Bike4Mind validates, scopes and revokes API keys
How Bike4Mind validates, scopes and revokes API keys How Bike4Mind validates, scopes and revokes API keys Bike4Mind Engineering · October 9, 2026 A Bike4Mind API key is a bearer credential. Whoever holds the string can call the endpoints its scopes allow, bill usage to its owner, and in some cases mint further keys. That makes the key system a small piece of code with a large blast radius, and over the last few months a good part of the team has worked on it from different directions: how fast a key is checked, what a key is allowed to do, what happens when two writes to the same key overlap, and what happens to a key when its owner's account is blocked. This post walks through those changes in the open-source core and the reasoning behind each. The checks an API-key request passes before it reaches a handler A request carrying a key is looked up, then checked against the stored key. The key must be unexpired and active. The route's required scope must be held by the key. The owning account must not be banned, suspended, or disputed. Only then does the route handler run. look up key check key matches stored key check status expiry, active check scope route scope check owner state banned, suspended, disputed route handler a failure at any step rejects the request Every key-authenticated request passes the same chain before it reaches a handler. Checking a key without a slow hash Keys used to be validated the way passwords are: the stored record held a bcrypt hash, and every...
View as plain text