[BE-59] Implement API Keys — generate and manage long-lived keys for external integrations

[yusuftomilola]

Overview

Third-party integrations and automation scripts need a stable, long-lived credential that doesn't require user login. An API key system provides this as an alternative to JWT tokens. Enables FE-26 (Developer portal API key management UI).

Context

• API keys should be scoped (read-only vs full access) so integrations only get the permissions they need
• Only the raw key is shown at creation time — the stored value is a bcrypt hash (like a password)
• The key is passed via Authorization: Bearer ak_<key> header — the JwtStrategy detects the ak_ prefix and validates via ApiKeyStrategy instead

Acceptance Criteria

• Create ApiKey entity: id, userId, name, keyHash (bcrypt hash of the raw key), prefix (first 8 chars, shown in list for identification), scopes (text array: ['read:assets', 'write:assets', 'read:reports', ...]), lastUsedAt, expiresAt (nullable), isActive, createdAt
• POST /api-keys body: { name, scopes, expiresAt? } — generates a crypto.randomBytes(32).toString('hex') key, returns it once in the response, stores only the hash
• GET /api-keys — list user's keys showing prefix, name, scopes, lastUsedAt (never the full key)
• DELETE /api-keys/:id — revokes key immediately
• Create ApiKeyStrategy for Passport — validates ak_ prefixed bearer tokens against stored hashes, updates lastUsedAt
• Update JwtAuthGuard to support both JWT and API key authentication

[RUKAYAT-CODER]

@RUKAYAT-CODER has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi can i work on this task?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @RUKAYAT-CODER to this issue.

[drips-wave]

Congratulations, @RUKAYAT-CODER! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @RUKAYAT-CODER: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊