[Feature] 希望增加多 API 密钥与 API 密钥权限管理 | Hope to Add Support for Multiple API Keys and API Key Permission Management

[yuyuko233]

下面的建议是针对 1Panel 面板的 API 功能, 而不是 AI 网关的 API

The following suggestions are for the API features of the 1Panel panel, not the API of the AI gateway

1Panel Version

v2.2.5

Please describe your needs or suggestions for improvements

目前在使用 API 接口遇到下面这两个问题, 希望可以增加多 API 密钥与 API 密钥权限管控功能:

1. 只有一个 API 密钥, 多个第三方应用共用一个, 出现泄露后所有使用这一个密钥的都需要更改, 并且在第三方应用不再需要使用这个密钥时无法吊销, 只能重新更改所有第三方应用的密钥
2. API 密钥的权限无法管理, 目前拿到 API 密钥后直接可以控制整台服务器, 一旦泄露无法最小化影响并且操作范围无法调控, 没办法限制这个密钥可以控制哪些功能或请求 API 接口, 比如: 通过 certd 管理多台多服务的 SSL 证书, certd 只需要一个更新证书的功能/接口其他的完全用不上

We are currently encountering the following two issues when using the API, and would like to see the addition of features for managing multiple API keys and API key permissions:

1. There is only one API key, which is shared by multiple third-party applications. If the key is compromised, all applications using it must change their keys. Furthermore, once a third-party application no longer needs the key, it cannot be revoked; and, the keys for all third-party applications must be changed.
2. API key permissions cannot be managed. Currently, once an API key is obtained, it grants direct control over the entire server. If leaked, the impact cannot be minimized, and the scope of operations cannot be controlled. There is no way to restrict which features the key can control or which API endpoints it can access. For example, using certd to manage SSL certificates for multiple servers and services; certd only requires a single feature or interface for updating certificates, and the rest is completely unnecessary.

Please describe the solution you suggest

希望能够增加 API 管理功能, 实现可以增删改查多个 API 密钥, 并且能够控制每个 API 密钥的权限范围

Hope to add API management features that allow us to create, delete, update, and query multiple API keys, as well as control the scope of permissions for each API key.

Additional Information

No response