Skip to content

docs: correct the API Keys page and API reference - #111

Merged
HughParry merged 1 commit into
mainfrom
docs/api-keys-page-fixes
Oct 7, 2026
Merged

HughParry merged 1 commit into
mainfrom
docs/api-keys-page-fixes

Conversation

@HughParry

Copy link
Copy Markdown

Fixes the API docs where they say things the product doesn't do. Answers prosopo/captcha-private#4486.

API Keys page

  • The key isn't shown only once. It stays on the API Keys page behind a show/hide toggle, and /api-keys/get returns it. The page now says so.
  • The examples called /v1/prosopo/provider/admin/rules, which doesn't exist. They now call POST /access-control/get.
  • Removed getSuggestion, getSuggestions, applySuggestions, updateApiKey and verify from the permission tables. No endpoint checks them. The page now notes that the dialog still offers the first four and that they do nothing.
  • Says plainly that verification uses the site's secret key, not an API key, and swaps the "give a verification key only verify" advice for an example that works.
  • Adds the Protect permissions (updateProtectSettings, ingestClientEvents), which the portal dialog now offers.
  • "Viewing Keys" listed a Created column that doesn't exist. It now lists Name, Token, Expires At and Permissions.
  • Expiry: "leave empty for a key that doesn't expire" is correct again since prosopo/captcha-private#5076, so it stays. Added that 0 does the same.

API reference

  • "Every key expires, default 30 days" became wrong when i18n(zh-cn): update guides/data-fetching.mdx withastro/docs#5076 shipped. It now says omitting expiresIn, or sending 0, gives a non-expiring key.
  • Removed "the portal can't grant Protect permissions". It can since prosopo/captcha-private#4716.
  • Documents the two client-event endpoints and their separate ingestClientEvents permission.

Testing: docs only. astro build passes, Prettier is clean, and the new anchors (#api-keys, #client-events) render. Every statement was checked against captcha-private main (createApiKey.ts, apiKeys.ts, ApiKeyCard.tsx, CreateApiKeyModal.tsx, serverless.yml, the Protect ingest handlers).

The API Keys page claimed keys are shown once, used an endpoint that does
not exist in its examples, and listed permissions no endpoint checks. The
API reference still said every key expires after 30 days, which stopped
being true when non-expiring keys shipped, and that the portal cannot grant
Protect permissions, which it now can.
@netlify

netlify Bot commented Oct 6, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for peaceful-pothos-9e62ce ready!

Name Link
🔨 Latest commit 453f523
🔍 Latest deploy log https://app.netlify.com/projects/peaceful-pothos-9e62ce/deploys/6ac4d8c8d646240008f9bcd4
😎 Deploy Preview https://deploy-preview-111--peaceful-pothos-9e62ce.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@HughParry
HughParry merged commit 80a2c25 into main Oct 7, 2026
6 checks passed
@HughParry
HughParry deleted the docs/api-keys-page-fixes branch October 7, 2026 12:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant