Function createApiKeyForUser

shared/auth/api-key-creation.ts:227–326

({
    authClient,
    dbBinding,
    userId,
    name,
    type,
    expiresIn,
    allowedModels,
    pollenBudget,
    accountPermissions,
    metadata,
    allowAccountKeysPermission,
    defaultCreatedVia,
}: CreateApiKeyForUserInput)

}

export async function createApiKeyForUser({
    authClient,
    dbBinding,
    userId,
    name,
    type,
    expiresIn,
    allowedModels,
    pollenBudget,
    accountPermissions,
    metadata,
    allowAccountKeysPermission,
    defaultCreatedVia,
}: CreateApiKeyForUserInput) {
    const db = drizzle(dbBinding, { schema });
    const attribution = await validateClientRedirectBinding(
        authClient,
        db,
        metadata,
    );

    const isPublishable = type === "publishable";
    const callerMetadata = pickCallerMetadata(metadata, isPublishable);
    if (Array.isArray(callerMetadata.redirectUris)) {
        for (const uri of callerMetadata.redirectUris as string[]) {
            validateRedirectUriFormat(uri);
        }
    }

    const sanitizedAccountPerms =
        sanitizeAuthorizeAccountPermissions(accountPermissions) ?? null;
    const safeAccountPerms = allowAccountKeysPermission
        ? sanitizedAccountPerms
        : (sanitizedAccountPerms?.filter((p) => p !== "keys") ?? null);

    const permissions: Record<string, string[]> = {};
    if (allowedModels) permissions.models = allowedModels;
    if (safeAccountPerms && safeAccountPerms.length > 0) {
        permissions.account = safeAccountPerms;
    }

    const prefix = isPublishable ? "pk" : "sk";
    const baseMetadata = {
        ...callerMetadata,
        keyType: type,
        createdVia: defaultCreatedVia,
    };

    const created = await authClient.api.createApiKey({
        body: {
            name,
            prefix,
            userId,
            ...(expiresIn != null && { expiresIn }),
            metadata: baseMetadata,
            permissions:
                Object.keys(permissions).length > 0 ? permissions : undefined,
        },