API Keys

The developer portal lets you create named API keys with scoped permissions. They model the integration flow of a real developer portal: create a key, copy it, and reference it from your app.

How keys work today

ThesisLock's read API is public and unauthenticated, so a key is not required to call any endpoint. Keys are generated and stored entirely in your browser's local storage under thesislock_api_keys. Nothing is sent to a server, and clearing site data removes them. This is an MVP: for production access control, validate keys server-side behind your own gateway.

Creating a key

• Open the API Keys tab in the developer portal.
• Select Create new API key, name it, and choose permissions.
• Copy the key from the reveal dialog and store it somewhere safe. The full key also stays available from the key list on this browser (it lives in local storage); revoke and replace it if it leaks.

Key format and permissions

Keys have the form tl_ followed by 32 hex characters, generated with crypto.getRandomValues. In lists they are masked to the prefix, the first six characters, and the last four. Permissions map to the public API surfaces:

• verify, search, stats, badges, profiles, and compare.

import { generateApiKey, maskKey } from '@/lib/apiKeys';

const key = generateApiKey();   // "tl_3f9a...." (35 chars)
maskKey(key);                   // "tl_3f9a1b...c4d2"

Ready to integrate? See the Integration Guides.