@@ -58,6 +56,10 @@
+
+
+
+
{{#if profile.isAdmin}}
diff --git a/portals/developer-portal/src/pages/api-keys-overview/page.hbs b/portals/developer-portal/src/pages/api-keys-overview/page.hbs
new file mode 100644
index 000000000..30c2669c5
--- /dev/null
+++ b/portals/developer-portal/src/pages/api-keys-overview/page.hbs
@@ -0,0 +1,208 @@
+
+
+{{#pageHead}}
+
+{{/pageHead}}
+{{#pageScripts}}
+
+{{/pageScripts}}
+
+
+
diff --git a/portals/developer-portal/src/routes/api/handlers/apiKeysHandler.js b/portals/developer-portal/src/routes/api/handlers/apiKeysHandler.js
index 3631628fb..73026e9d5 100644
--- a/portals/developer-portal/src/routes/api/handlers/apiKeysHandler.js
+++ b/portals/developer-portal/src/routes/api/handlers/apiKeysHandler.js
@@ -29,6 +29,7 @@ const { compose } = require('./compose');
module.exports = {
generateApiKey: compose(requireCsrfForMutatingApi, apiKeyController.generateApiKey),
listApiKeys: apiKeyController.listApiKeys,
+ listAllApiKeys: apiKeyController.listAllApiKeys,
regenerateApiKey: compose(requireCsrfForMutatingApi, apiKeyController.regenerateApiKey),
revokeApiKey: compose(requireCsrfForMutatingApi, apiKeyController.revokeApiKey),
associateApiKeyApplication: compose(requireCsrfForMutatingApi, apiKeyController.associateApiKeyApplication),
diff --git a/portals/developer-portal/src/routes/pages/apiKeysOverviewRoute.js b/portals/developer-portal/src/routes/pages/apiKeysOverviewRoute.js
new file mode 100644
index 000000000..d278be472
--- /dev/null
+++ b/portals/developer-portal/src/routes/pages/apiKeysOverviewRoute.js
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026, WSO2 LLC. (http://www.wso2.com) All Rights Reserved.
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+const express = require('express');
+const router = express.Router();
+const apiKeysOverviewController = require('../../controllers/apiKeysOverviewController');
+const registerPartials = require('../../middlewares/registerPartials');
+const { ensureAuthenticated } = require('../../middlewares/ensureAuthenticated');
+
+router.get('/:orgName/views/:viewName/api-keys', (req, res, next) => {
+ if (req.params.orgName === 'favicon.ico') {
+ return res.status(404).send('Not Found');
+ }
+ next();
+}, registerPartials, ensureAuthenticated, apiKeysOverviewController.loadApiKeysOverview);
+
+module.exports = router;
diff --git a/portals/developer-portal/src/scripts/api-keys-overview.js b/portals/developer-portal/src/scripts/api-keys-overview.js
new file mode 100644
index 000000000..b9f52452c
--- /dev/null
+++ b/portals/developer-portal/src/scripts/api-keys-overview.js
@@ -0,0 +1,313 @@
+/*
+ * Copyright (c) 2026, WSO2 LLC. (http://www.wso2.com) All Rights Reserved.
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/* eslint-disable no-undef */
+
+// Global "API Keys" page. The list is rendered server-side; this script handles inline
+// per-key management using the SAME modals as the per-API API Keys page
+// (regenerateApiKeyModal, showApiKeySecretModal, ak-revoke-modal, ak-app-modal). It reads
+// each row's data-* attributes and calls the per-API or per-MCP-server key endpoints,
+// then reloads on success. MCP-server keys are routed to /mcp-servers/{handle}/api-keys/...
+// — the /apis/{apiId} path only resolves non-MCP APIs.
+(function () {
+ var root = document.getElementById('api-keys-overview-root');
+ if (!root) return;
+ var readOnly = root.dataset.readOnly === 'true';
+
+ var _manageKey = null; // key whose row action is currently in progress
+ var _apps = null; // cached applications list (fetched lazily on first associate)
+ var _copyTimer = null;
+ var _actionInFlight = false;
+
+ /* ── helpers ──────────────────────────────────────────────── */
+
+ function mutationHeaders() {
+ return { 'Content-Type': 'application/json', 'X-CSRF-Token': window.devportalApi.csrfToken() };
+ }
+ function show(id) { var el = document.getElementById(id); if (el) el.style.display = 'flex'; }
+ function hide(id) { var el = document.getElementById(id); if (el) el.style.display = 'none'; }
+ async function alertMsg(message, type) {
+ if (typeof showAlert === 'function') { try { await showAlert(message, type); } catch (e) { /* noop */ } }
+ }
+ function isMcp(key) {
+ return String((key && key.apiType) || '').toUpperCase() === 'MCP';
+ }
+ function expiresToIso(val) {
+ if (!val || !String(val).trim()) return null;
+ var d = new Date(val);
+ if (isNaN(d.getTime())) return null;
+ return d.toISOString();
+ }
+
+ // Resolve the acting key from the clicked button's row. Keys are identified by their
+ // handle (the external id); the uuid is never rendered or used here.
+ function setActingKey(btn) {
+ var tr = btn.closest ? btn.closest('tr') : null;
+ var d = tr && tr.dataset;
+ if (!d || !d.keyHandle) return false;
+ _manageKey = {
+ handle: d.keyHandle, // what the mutation endpoints expect as `keyId`
+ apiId: d.apiId,
+ apiType: d.apiType,
+ displayName: d.keyName || '',
+ status: d.status || '',
+ appId: d.appId || '',
+ appDisplayName: d.appDisplayName || '',
+ };
+ return true;
+ }
+
+ // MCP servers expose an identical but separately-rooted key API
+ // (/mcp-servers/{handle}/api-keys/...). Pick the base from the key's apiType.
+ function keyEndpoint(suffix) {
+ var base = isMcp(_manageKey) ? '/mcp-servers/' : '/apis/';
+ return devportalApi.root(base + encodeURIComponent(_manageKey.apiId) + '/api-keys/' + suffix);
+ }
+
+ /* ── regenerate modal ─────────────────────────────────────── */
+
+ function openRegenerate() {
+ document.getElementById('regenerate-key-id').value = _manageKey.handle;
+ document.getElementById('regenerate-api-key-name').value = _manageKey.displayName || '';
+ var exp = document.getElementById('regenerate-api-key-expires');
+ if (exp) exp.value = '';
+ show('regenerateApiKeyModal');
+ }
+
+ async function submitRegenerate() {
+ if (!_manageKey || _actionInFlight) return;
+ var key = _manageKey;
+ var expInput = document.getElementById('regenerate-api-key-expires');
+ var body = { keyId: key.handle };
+ var iso = expInput ? expiresToIso(expInput.value) : null;
+ if (iso) body.expiresAt = iso;
+ _actionInFlight = true;
+ var btn = document.getElementById('btn-submit-regenerate-api-key');
+ btn.disabled = true;
+ try {
+ var resp = await fetch(keyEndpoint('regenerate'), {
+ method: 'POST', credentials: 'same-origin',
+ headers: mutationHeaders(), body: JSON.stringify(body),
+ });
+ var data = await resp.json().catch(function () { return {}; });
+ if (!resp.ok) throw new Error(data.description || data.message || 'Failed to regenerate API key');
+ hide('regenerateApiKeyModal');
+ showSecret(data.key || '', key.displayName || '');
+ } catch (e) {
+ await alertMsg(e.message || 'Failed to regenerate API key', 'error');
+ } finally {
+ _actionInFlight = false;
+ btn.disabled = false;
+ }
+ }
+
+ /* ── revoke modal ─────────────────────────────────────────── */
+
+ function openRevoke() {
+ document.getElementById('ak-revoke-name').textContent = _manageKey.displayName || '';
+ var confirmBtn = document.getElementById('ak-revoke-confirm');
+ if (confirmBtn) { confirmBtn.disabled = false; confirmBtn.textContent = 'Revoke key'; }
+ show('ak-revoke-modal');
+ }
+
+ async function submitRevoke() {
+ if (!_manageKey || _actionInFlight) return;
+ var key = _manageKey;
+ _actionInFlight = true;
+ var btn = document.getElementById('ak-revoke-confirm');
+ btn.disabled = true; btn.textContent = 'Revoking…';
+ try {
+ var resp = await fetch(keyEndpoint('revoke'), {
+ method: 'POST', credentials: 'same-origin',
+ headers: mutationHeaders(), body: JSON.stringify({ keyId: key.handle }),
+ });
+ if (!resp.ok) {
+ var data = await resp.json().catch(function () { return {}; });
+ throw new Error(data.description || data.message || 'Failed to revoke API key');
+ }
+ hide('ak-revoke-modal');
+ await alertMsg('API key revoked.', 'success');
+ window.location.reload();
+ } catch (e) {
+ await alertMsg(e.message || 'Failed to revoke API key', 'error');
+ _actionInFlight = false;
+ btn.disabled = false; btn.textContent = 'Revoke key';
+ }
+ }
+
+ /* ── associate app modal ──────────────────────────────────── */
+
+ async function loadApps() {
+ if (_apps) return _apps;
+ try {
+ var resp = await fetch(devportalApi.root('/applications'), { headers: mutationHeaders() });
+ if (!resp.ok) return [];
+ var data = await resp.json();
+ // The associate endpoint expects the app handle, returned as `id` here.
+ _apps = ((data && data.list) || []).map(function (a) { return { appId: a.id, displayName: a.displayName }; });
+ } catch (e) {
+ return [];
+ }
+ return _apps;
+ }
+
+ async function openAppModal() {
+ if (!_manageKey) return;
+ var keyIdInput = document.getElementById('ak-app-key-id');
+ if (keyIdInput) keyIdInput.value = _manageKey.handle;
+ var apps = await loadApps();
+ var select = document.getElementById('ak-app-select');
+ select.innerHTML = '';
+ apps.forEach(function (app) {
+ var opt = document.createElement('option');
+ opt.value = app.appId;
+ opt.textContent = app.displayName;
+ if (app.appId === _manageKey.appId) opt.selected = true;
+ select.appendChild(opt);
+ });
+ show('ak-app-modal');
+ }
+
+ async function saveAppAssociation() {
+ if (!_manageKey || _actionInFlight) return;
+ var key = _manageKey;
+ var select = document.getElementById('ak-app-select');
+ var appId = select ? select.value : '';
+ _actionInFlight = true;
+ var btn = document.getElementById('btn-submit-app-association');
+ btn.disabled = true;
+ try {
+ var resp = await fetch(keyEndpoint(appId ? 'associate' : 'dissociate'), {
+ method: 'POST', credentials: 'same-origin',
+ headers: mutationHeaders(),
+ body: JSON.stringify(appId ? { keyId: key.handle, appId: appId } : { keyId: key.handle }),
+ });
+ if (!resp.ok) {
+ var data = await resp.json().catch(function () { return {}; });
+ throw new Error(data.description || data.message || 'Failed to update app association');
+ }
+ hide('ak-app-modal');
+ window.location.reload();
+ } catch (e) {
+ await alertMsg(e.message || 'Failed to update app association', 'error');
+ _actionInFlight = false;
+ btn.disabled = false;
+ }
+ }
+
+ /* ── secret modal ─────────────────────────────────────────── */
+
+ function showSecret(value, keyName) {
+ document.getElementById('api-key-secret-value').textContent = value || '';
+ document.getElementById('ak-secret-key-name').textContent = keyName || '';
+ var copyBtn = document.getElementById('btn-copy-api-key-secret');
+ if (copyBtn) copyBtn.classList.remove('copy-btn--copied');
+ show('showApiKeySecretModal');
+ }
+
+ function closeSecret() {
+ hide('showApiKeySecretModal');
+ window.location.reload(); // refresh the list after regeneration
+ }
+
+ function copySecret() {
+ var codeEl = document.getElementById('api-key-secret-value');
+ var text = codeEl ? codeEl.textContent : '';
+ if (!text) return;
+ try {
+ if (navigator.clipboard && navigator.clipboard.writeText) {
+ navigator.clipboard.writeText(text).catch(function () {});
+ } else {
+ var ta = document.createElement('textarea');
+ ta.value = text; ta.style.cssText = 'position:fixed;opacity:0';
+ document.body.appendChild(ta); ta.select(); document.execCommand('copy');
+ document.body.removeChild(ta);
+ }
+ } catch (e) { /* noop */ }
+ var btn = document.getElementById('btn-copy-api-key-secret');
+ if (btn) {
+ btn.classList.add('copy-btn--copied');
+ if (_copyTimer) clearTimeout(_copyTimer);
+ _copyTimer = setTimeout(function () { btn.classList.remove('copy-btn--copied'); }, 1600);
+ }
+ }
+
+ /* ── wiring ───────────────────────────────────────────────── */
+
+ function backdrop(id) {
+ var el = document.getElementById(id);
+ if (el) el.addEventListener('click', function (e) { if (e.target === el) hide(id); });
+ }
+
+ function wire() {
+ if (readOnly) return;
+
+ // Row action buttons (server-rendered).
+ document.querySelectorAll('.ak-row-app').forEach(function (btn) {
+ btn.addEventListener('click', function () { if (btn.disabled || !setActingKey(btn)) return; openAppModal(); });
+ });
+ document.querySelectorAll('.ak-row-regen').forEach(function (btn) {
+ btn.addEventListener('click', function () { if (btn.disabled || !setActingKey(btn)) return; openRegenerate(); });
+ });
+ document.querySelectorAll('.ak-row-revoke').forEach(function (btn) {
+ btn.addEventListener('click', function () { if (btn.disabled || !setActingKey(btn)) return; openRevoke(); });
+ });
+
+ // Regenerate modal
+ var regClose = document.getElementById('ak-regen-close');
+ if (regClose) regClose.addEventListener('click', function () { hide('regenerateApiKeyModal'); });
+ var regCancel = document.getElementById('ak-regen-cancel');
+ if (regCancel) regCancel.addEventListener('click', function () { hide('regenerateApiKeyModal'); });
+ var regSubmit = document.getElementById('btn-submit-regenerate-api-key');
+ if (regSubmit) regSubmit.addEventListener('click', submitRegenerate);
+ backdrop('regenerateApiKeyModal');
+
+ // Revoke modal
+ var revCancel = document.getElementById('ak-revoke-cancel');
+ if (revCancel) revCancel.addEventListener('click', function () { hide('ak-revoke-modal'); });
+ var revConfirm = document.getElementById('ak-revoke-confirm');
+ if (revConfirm) revConfirm.addEventListener('click', submitRevoke);
+ backdrop('ak-revoke-modal');
+
+ // Associate app modal
+ var appClose = document.getElementById('ak-app-close');
+ if (appClose) appClose.addEventListener('click', function () { hide('ak-app-modal'); });
+ var appCancel = document.getElementById('ak-app-cancel');
+ if (appCancel) appCancel.addEventListener('click', function () { hide('ak-app-modal'); });
+ var appSubmit = document.getElementById('btn-submit-app-association');
+ if (appSubmit) appSubmit.addEventListener('click', saveAppAssociation);
+ backdrop('ak-app-modal');
+
+ // Secret modal
+ var secDone = document.getElementById('ak-secret-done');
+ if (secDone) secDone.addEventListener('click', closeSecret);
+ var secClose = document.getElementById('ak-secret-close');
+ if (secClose) secClose.addEventListener('click', closeSecret);
+ var secCopy = document.getElementById('btn-copy-api-key-secret');
+ if (secCopy) secCopy.addEventListener('click', copySecret);
+ var secretModal = document.getElementById('showApiKeySecretModal');
+ if (secretModal) secretModal.addEventListener('click', function (e) { if (e.target === secretModal) closeSecret(); });
+ }
+
+ function init() { wire(); }
+
+ if (document.readyState === 'loading') {
+ document.addEventListener('DOMContentLoaded', init);
+ } else {
+ init();
+ }
+}());
diff --git a/portals/developer-portal/src/scripts/common.js b/portals/developer-portal/src/scripts/common.js
index ecba0f384..522d05554 100644
--- a/portals/developer-portal/src/scripts/common.js
+++ b/portals/developer-portal/src/scripts/common.js
@@ -93,20 +93,34 @@ document.addEventListener("DOMContentLoaded", function () {
const basePath = extractBasePath();
+ // Resolve the path segment that follows the view-scoped base path so nav
+ // matching is exact. e.g. "/org/views/default/api-keys" -> firstSegment "api-keys".
+ // Settings is org-scoped (/:org/settings) and does not sit under basePath, so it
+ // is handled via a suffix check below.
+ let rest = currentPath;
+ if (basePath && currentPath.indexOf(basePath) === 0) {
+ rest = currentPath.slice(basePath.length);
+ }
+ const firstSegment = rest.replace(/^\/+/, '').split('/')[0];
+
// Remove active class from all links
navLinks.forEach(link => link.classList.remove('active'));
- // Set the active class based on path
- if (currentPath.endsWith('/') || currentPath === '') {
+ // Match on the first path segment. Order the singular API/MCP detail routes
+ // (submenu-bearing) before the plural listing routes, and guard optional
+ // submenu elements — they are absent in single-mode portals
+ // (APIS_ONLY / MCP_SERVERS_ONLY).
+ if (firstSegment === '') {
document.getElementById('home')?.classList.add('active');
- apiSubmenu.classList.remove('show');
+ apiSubmenu?.classList.remove('show');
apisLink?.classList.remove('has-active-submenu');
- } else if (currentPath.includes('/apis')) {
- apisLink?.classList.add('active');
- apiSubmenu.classList.remove('show');
- apisLink?.classList.remove('has-active-submenu');
- } else if (currentPath.includes('/api/')) {
- apiSubmenu.classList.add('show');
+ } else if (firstSegment === 'api-workflows') {
+ document.getElementById('api-workflows')?.classList.add('active');
+ } else if (firstSegment === 'api-keys') {
+ // Global API Keys page (distinct from the per-API /api/:id/api-keys submenu item)
+ document.getElementById('api-keys')?.classList.add('active');
+ } else if (firstSegment === 'api') {
+ apiSubmenu?.classList.add('show');
apisLink?.classList.add('active');
apisLink?.classList.add('has-active-submenu');
@@ -116,8 +130,10 @@ document.addEventListener("DOMContentLoaded", function () {
const apiId = apiIdMatch[1];
// Update the submenu links with the correct API ID and base path
- document.getElementById('api-overview').href = `${basePath}/api/${apiId}`;
- document.getElementById('api-docs').href = `${basePath}/api/${apiId}/docs/specification`;
+ const overviewLink = document.getElementById('api-overview');
+ if (overviewLink) overviewLink.href = `${basePath}/api/${apiId}`;
+ const docsLink = document.getElementById('api-docs');
+ if (docsLink) docsLink.href = `${basePath}/api/${apiId}/docs/specification`;
const apiKeysLink = document.getElementById('api-keys-nav');
if (apiKeysLink) {
apiKeysLink.href = `${basePath}/api/${apiId}/api-keys`;
@@ -132,14 +148,14 @@ document.addEventListener("DOMContentLoaded", function () {
document.getElementById('api-overview')?.classList.add('active');
}
}
- } else if (currentPath.includes('/applications/') || currentPath.includes('/applications')) {
+ } else if (firstSegment === 'apis') {
+ apisLink?.classList.add('active');
+ apiSubmenu?.classList.remove('show');
+ apisLink?.classList.remove('has-active-submenu');
+ } else if (firstSegment === 'applications') {
applicationsLink?.classList.add('active');
- } else if (currentPath.includes('/mcps')) {
- document.getElementById('mcps')?.classList.add('active');
- mcpSubmenu.classList.remove('show');
- mcpLink?.classList.remove('has-active-submenu');
- } else if (currentPath.includes('/mcp/')) {
- mcpSubmenu.classList.add('show');
+ } else if (firstSegment === 'mcp') {
+ mcpSubmenu?.classList.add('show');
mcpLink?.classList.add('active');
mcpLink?.classList.add('has-active-submenu');
@@ -149,8 +165,10 @@ document.addEventListener("DOMContentLoaded", function () {
const apiId = apiIdMatch[1];
// Update the submenu links with the correct API ID and base path
- document.getElementById('mcp-overview').href = `${basePath}/mcp/${apiId}`;
- document.getElementById('mcp-docs').href = `${basePath}/mcp/${apiId}/docs/specification`;
+ const mcpOverviewLink = document.getElementById('mcp-overview');
+ if (mcpOverviewLink) mcpOverviewLink.href = `${basePath}/mcp/${apiId}`;
+ const mcpDocsLink = document.getElementById('mcp-docs');
+ if (mcpDocsLink) mcpDocsLink.href = `${basePath}/mcp/${apiId}/docs/specification`;
// Set active submenu item
if (currentPath.includes('/docs')) {
@@ -159,8 +177,14 @@ document.addEventListener("DOMContentLoaded", function () {
document.getElementById('mcp-overview')?.classList.add('active');
}
}
- } else if (currentPath.includes('/subscriptions')) {
+ } else if (firstSegment === 'mcps') {
+ document.getElementById('mcps')?.classList.add('active');
+ mcpSubmenu?.classList.remove('show');
+ mcpLink?.classList.remove('has-active-submenu');
+ } else if (firstSegment === 'subscriptions') {
document.getElementById('subscriptions')?.classList.add('active');
+ } else if (firstSegment === 'settings' || currentPath.includes('/settings')) {
+ document.getElementById('admin-settings')?.classList.add('active');
}
};
diff --git a/tests/integration-e2e/devportal-config.toml b/tests/integration-e2e/devportal-config.toml
new file mode 100644
index 000000000..c09acbe82
--- /dev/null
+++ b/tests/integration-e2e/devportal-config.toml
@@ -0,0 +1,53 @@
+# Developer Portal configuration for the Go integration-e2e stack.
+#
+# Mounted at /app/configs/config.toml in the devportal container. It replaces
+# the image's shipped configs/config.toml, which fails closed at startup on the
+# required security secrets and only wires the SQLite `file` key — neither of
+# which suits this postgres-backed e2e stack.
+#
+# There is NO automatic APIP_DP_* environment-variable override (see
+# src/config/configLoader.js) — an env var set in docker-compose.yaml's
+# `devportal.environment` block only takes effect where a key below explicitly
+# references it via a {{ env "..." }} token. Every APIP_DP_* var the compose
+# file relies on MUST have a matching token here, or the override is silently
+# ignored and the built-in default (src/config/configDefaults.js) is used.
+
+[server]
+base_url = '{{ env "APIP_DP_SERVER_BASEURL" "http://devportal:3000" }}'
+
+[tls]
+# Plain HTTP inside the compose network — the e2e client talks to it over http.
+enabled = false
+
+[logging]
+console_only = true
+
+[database]
+# Postgres, not the devportal's default SQLite: the org-update path needs
+# UPDATE ... RETURNING, which SQLite doesn't support. Connection comes from the
+# APIP_DP_DATABASE_* vars in the compose file.
+type = '{{ env "APIP_DP_DATABASE_TYPE" "postgres" }}'
+host = '{{ env "APIP_DP_DATABASE_HOST" "postgres" }}'
+port = '{{ env "APIP_DP_DATABASE_PORT" "5432" }}'
+name = '{{ env "APIP_DP_DATABASE_NAME" "devportal" }}'
+username = '{{ env "APIP_DP_DATABASE_USERNAME" "apip" }}'
+password = '{{ env "APIP_DP_DATABASE_PASSWORD" "apip" }}'
+
+[organization]
+# Seed the "default" org so its handle matches platform-api's org handle
+# (the webhook resolves the control-plane org by handle via org.ref_id).
+default_name = '{{ env "APIP_DP_ORGANIZATION_DEFAULTNAME" "default" }}'
+auto_create_subscription_plans = false
+
+[platform_api]
+# The devportal validates the platform-api admin JWT locally; jwt_secret MUST
+# equal the stack's APIP_CP_AUTH_JWT_SECRET_KEY so the admin token is accepted.
+base_url = '{{ env "APIP_DP_PLATFORMAPI_BASEURL" "https://platform-api:9243" }}'
+jwt_secret = '{{ env "APIP_DP_PLATFORMAPI_JWTSECRET" }}'
+insecure = true
+
+[security]
+# Required — devportal fails closed at startup if either doesn't resolve to a
+# 64-char hex string. Fixed test-only values set in the compose file.
+encryption_key = '{{ env "APIP_DP_SECURITY_ENCRYPTIONKEY" }}'
+session_secret = '{{ env "APIP_DP_SECURITY_SESSIONSECRET" }}'
diff --git a/tests/integration-e2e/docker-compose.yaml b/tests/integration-e2e/docker-compose.yaml
index dabcd0822..d80997242 100644
--- a/tests/integration-e2e/docker-compose.yaml
+++ b/tests/integration-e2e/docker-compose.yaml
@@ -233,6 +233,13 @@ services:
condition: service_healthy
platform-api:
condition: service_started
+ volumes:
+ # The devportal has no automatic APIP_DP_* env override (see
+ # src/config/configLoader.js) — an APIP_DP_* var only applies where this
+ # config.toml references it via {{ env "..." }}. It replaces the image's
+ # shipped configs/config.toml, which fails closed on the security secrets
+ # and wires only the SQLite file key (ignoring APIP_DP_DATABASE_TYPE etc.).
+ - ./devportal-config.toml:/app/configs/config.toml:ro
environment:
# Its own database on the shared postgres server (created by init-db.sql).
# Postgres, not the devportal's default SQLite: the org-update path needs
@@ -266,6 +273,9 @@ services:
# secret at rest; must not change across restarts or the stored secret
# becomes undecryptable and outbound requests go unsigned.
- APIP_DP_SECURITY_ENCRYPTIONKEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+ # express-session signing secret (64 hex). Required — the devportal fails
+ # closed at startup if it doesn't resolve. Fixed test-only value.
+ - APIP_DP_SECURITY_SESSIONSECRET=fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210
ports:
- "${DP_HOST_PORT:-3000}:3000"
networks: [e2e]
+
+
+ {{!-- The list is rendered server-side (all keys, no client pagination). Per-key
+ management happens inline through the modals below (mirrors the Subscriptions
+ page); api-keys-overview.js reads each row's data-* attributes and calls the
+ per-API / per-MCP REST endpoints. --}}
+
+
+ API Keys
+API keys you've generated across all APIs. Manage a key inline — regenerate or revoke it.
+
+
+ {{#if apiKeysLoadError}}
+
+
+ {{> alert }}
+
+ {{#unless isReadOnlyMode}}
+
+
+
+
+
+
+
+
+
+
+
+ {{/unless}}
+
+ Unable to load API keys. Refresh the page or try again later.
+
+ {{else if apiKeys.length}}
+
+
+
+
+
+ {{else}}
+ | API | Name | Status | Expires | Application | Actions | +
|---|---|---|---|---|---|
| + {{#if this.apiName}}{{this.apiName}}{{else}}{{this.apiHandle}}{{/if}} + {{#if this.apiVersion}}{{this.apiVersion}}{{/if}} + | +{{this.displayName}} | ++ + {{lowercase this.status}} + + | +{{#if this.expiresAt}}{{formatExpiresAt this.expiresAt}}{{else}}Never{{/if}} | +{{#if this.appDisplayName}}{{this.appDisplayName}}{{else}}-{{/if}} | +
+ {{#if @root.isReadOnlyMode}}
+ Read only
+ {{else}}
+
+
+
+
+
+ {{/if}}
+ |
+
+
+
+ {{/if}}
+ No API keys yet
+Open an API that supports API-key access and generate a key from its API Keys tab. Your keys will show up here.
+