API Keys Have Scoped Permissions

API keys without scope restrictions grant the same access as the owner's full session — a compromised key is equivalent to a compromised account. CWE-285 (Improper Authorization) and CWE-284 cover the failure to limit what an API key can do. OWASP A01 (Broken Access Control) flags credential over-privilege as a primary risk. NIST 800-53 AC-6 (Least Privilege) and IA-3 (Device Identification) require that credentials be limited to their intended purpose. A read-only integration that holds a full-permission key can delete all user data, initiate payment changes, or export sensitive records — damage that scoped keys would prevent.

Add a scopes array to the API key model and enforce scope checks during request handling. The key is only valid for operations that match its declared scopes.

// prisma/schema.prisma
model ApiKey {
  id     String   @id @default(cuid())
  userId String
  scopes String[] // e.g., ['read:posts', 'write:posts']
}

// lib/auth/api-key.ts
export async function validateApiKey(key: string, requiredScope: string) {
  const apiKey = await db.apiKey.findUnique({ where: { key } });
  if (!apiKey || !apiKey.scopes.includes(requiredScope)) return null;
  return apiKey;
}

When generating keys, let users select which scopes to grant — this enforces least privilege at the point of creation rather than relying on callers to self-limit.