[Feature]: REST API for User Token CRUD Operations

[alexlovelltroy]

Describe the feature

Provide REST endpoints for users to create, list, and revoke their own API keys, eliminating the need for CLI access and enabling programmatic token management.

API Endpoints

1. List User's Tokens

Endpoint: GET /api/v1/tokens

Authentication: Requires valid TokenSmith JWT (from OIDC exchange)

Response (200 OK):

{
  "tokens": [
    {
      "id": 1,
      "name": "my-api-key",
      "scopes": ["read", "write"],
      "created_at": "2026-06-20T10:00:00Z",
      "expires_at": null,
      "revoked_at": null
    },
    {
      "id": 2,
      "name": "ci-cd-token",
      "scopes": ["read"],
      "created_at": "2026-06-21T15:30:00Z",
      "expires_at": "2027-06-21T15:30:00Z",
      "revoked_at": null
    }
  ]
}

Note: Token values (secrets) are NOT returned. They were shown once during creation.

---

2. Create New Token

Endpoint: POST /api/v1/tokens

Authentication: Requires valid TokenSmith JWT

Request Body (JSON):

{
  "name": "my-new-token",
  "scopes": ["read", "write"],
  "expires_at": "2027-06-25T00:00:00Z"  // Optional, null = no expiration
}

Response (201 Created):

{
  "id": 3,
  "name": "my-new-token",
  "value": "Mw==.ZEdWemRGOTBiMmRsbGo...",  // ONLY shown once!
  "scopes": ["read", "write"],
  "created_at": "2026-06-25T10:30:00Z",
  "expires_at": "2027-06-25T00:00:00Z"
}

Important: The value field is only returned in the creation response. Store it securely immediately.

---

3. Revoke Token by ID

Endpoint: DELETE /api/v1/tokens/{id}

Authentication: Requires valid TokenSmith JWT

Authorization: User can only revoke their own tokens

Response (204 No Content)**:

(empty body)

Response (404 Not Found):

{
  "error": "not_found",
  "error_description": "Token not found or not owned by user"
}

---

Authorization Rules

1. Authenticated Users: All endpoints require valid TokenSmith JWT
2. Ownership: Users can only manage their own tokens (filter by user_id from JWT sub claim)
3. Admin Override: Optional - admins can view/revoke any user's tokens (future enhancement)

Why do you want this feature?

Allow users to manage their own tokens/API Keys.

Alternatives you've considered

I considered doing...

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct