From d510e96541946507dbe225ad8fd1292baf1970b6 Mon Sep 17 00:00:00 2001
From: beo3000 <pakabu@web.de>
Date: Mon, 23 Feb 2026 15:44:10 +0100
Subject: [PATCH] added api-keys

---
 ka-note/VERSION                               |    2 +-
 .../client/src/routes/settings/+page.svelte   |  143 +++
 ka-note/server/drizzle/0010_sharp_bishop.sql  |   13 +
 .../server/drizzle/meta/0010_snapshot.json    | 1137 +++++++++++++++++
 ka-note/server/drizzle/meta/_journal.json     |    7 +
 ka-note/server/src/db/schema.ts               |   13 +
 ka-note/server/src/index.ts                   |    4 +
 ka-note/server/src/middleware/auth.ts         |   23 +
 ka-note/server/src/routes/api-keys.ts         |   62 +
 9 files changed, 1403 insertions(+), 1 deletion(-)
 create mode 100644 ka-note/server/drizzle/0010_sharp_bishop.sql
 create mode 100644 ka-note/server/drizzle/meta/0010_snapshot.json
 create mode 100644 ka-note/server/src/routes/api-keys.ts

diff --git a/ka-note/VERSION b/ka-note/VERSION
index f4173b1..cb13578 100644
--- a/ka-note/VERSION
+++ b/ka-note/VERSION
@@ -1 +1 @@
-1.1.26
\ No newline at end of file
+1.1.27
\ No newline at end of file
diff --git a/ka-note/client/src/routes/settings/+page.svelte b/ka-note/client/src/routes/settings/+page.svelte
index 7289551..b158c58 100644
--- a/ka-note/client/src/routes/settings/+page.svelte
+++ b/ka-note/client/src/routes/settings/+page.svelte
@@ -1,10 +1,86 @@
 <script lang="ts">
 	import { scopeSettings, currentScope, type ScopeSettings } from '$lib/stores/scopeContext';
+	import { authFetch } from '$lib/auth/apiClient.js';
+	import ConfirmDialog from '$lib/components/ConfirmDialog.svelte';
+	import { onMount } from 'svelte';
 
 	currentScope.set(null);
 
+	const API_BASE = import.meta.env.VITE_API_URL ?? '';
+
 	let settings = $state<ScopeSettings>({ ...$scopeSettings });
 
+	// --- API Keys ---
+	interface ApiKey {
+		id: string;
+		label: string;
+		createdAt: string | number;
+		lastUsedAt: string | number | null;
+	}
+
+	let apiKeysList = $state<ApiKey[]>([]);
+	let apiKeysLoading = $state(false);
+	let apiKeysError = $state<string | null>(null);
+	let newKeyLabel = $state('');
+	let newKeyCreating = $state(false);
+	let newKeyValue = $state<string | null>(null);
+	let confirmDelete = $state<ApiKey | null>(null);
+
+	function fmtDate(val: string | number | null | undefined): string {
+		if (!val) return '–';
+		return new Date(typeof val === 'number' ? val : val).toLocaleDateString('de-DE');
+	}
+
+	async function loadApiKeys() {
+		apiKeysLoading = true;
+		apiKeysError = null;
+		try {
+			const res = await authFetch(`${API_BASE}/api/api-keys`);
+			if (!res.ok) throw new Error(`HTTP ${res.status}`);
+			apiKeysList = await res.json() as ApiKey[];
+		} catch (e: unknown) {
+			apiKeysError = e instanceof Error ? e.message : 'Fehler';
+		} finally {
+			apiKeysLoading = false;
+		}
+	}
+
+	async function createApiKey() {
+		if (!newKeyLabel.trim()) return;
+		newKeyCreating = true;
+		apiKeysError = null;
+		try {
+			const res = await authFetch(`${API_BASE}/api/api-keys`, {
+				method: 'POST',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ label: newKeyLabel.trim() }),
+			});
+			if (!res.ok) throw new Error(`HTTP ${res.status}`);
+			const data = await res.json() as ApiKey & { key: string };
+			newKeyValue = data.key;
+			newKeyLabel = '';
+			await loadApiKeys();
+		} catch (e: unknown) {
+			apiKeysError = e instanceof Error ? e.message : 'Fehler';
+		} finally {
+			newKeyCreating = false;
+		}
+	}
+
+	async function deleteApiKey(key: ApiKey) {
+		try {
+			const res = await authFetch(`${API_BASE}/api/api-keys/${key.id}`, { method: 'DELETE' });
+			if (!res.ok) throw new Error(`HTTP ${res.status}`);
+			await loadApiKeys();
+		} catch (e: unknown) {
+			apiKeysError = e instanceof Error ? e.message : 'Fehler';
+		} finally {
+			confirmDelete = null;
+		}
+	}
+
+	onMount(loadApiKeys);
+
 	function save() {
 		scopeSettings.set({ ...settings });
 	}
@@ -91,4 +167,71 @@
 			Auf Standard zurücksetzen
 		</button>
 	</section>
+
+	<!-- API Keys -->
+	<section class="space-y-4">
+		<h2 class="text-sm font-semibold uppercase text-muted">API Keys</h2>
+		<p class="text-xs text-muted">Für Automationen und Maschinen-Zugänge (z.B. iOS Kurzbefehle). Der Key wird nur einmal angezeigt.</p>
+
+		{#if apiKeysError}
+			<p class="text-xs text-red-400">{apiKeysError}</p>
+		{/if}
+
+		{#if newKeyValue}
+			<div class="rounded border border-green-600 bg-green-950/40 p-3 space-y-2">
+				<p class="text-xs text-green-400 font-semibold">Neuer Key — jetzt kopieren, wird nicht mehr angezeigt:</p>
+				<code class="block break-all text-xs font-mono text-green-300 select-all">{newKeyValue}</code>
+				<button class="text-xs text-muted hover:text-white underline" onclick={() => newKeyValue = null}>Schliessen</button>
+			</div>
+		{/if}
+
+		<!-- existing keys -->
+		{#if apiKeysLoading}
+			<p class="text-xs text-muted">Laden...</p>
+		{:else if apiKeysList.length === 0}
+			<p class="text-xs text-muted">Keine API Keys vorhanden.</p>
+		{:else}
+			<ul class="space-y-2">
+				{#each apiKeysList as key (key.id)}
+					<li class="flex items-center justify-between rounded border border-border bg-card-bg px-3 py-2">
+						<div>
+							<span class="text-sm font-medium">{key.label}</span>
+							<span class="ml-3 text-xs text-muted">erstellt {fmtDate(key.createdAt)}</span>
+							{#if key.lastUsedAt}
+								<span class="ml-2 text-xs text-muted">zuletzt {fmtDate(key.lastUsedAt)}</span>
+							{/if}
+						</div>
+						<button
+							class="text-xs text-red-400 hover:text-red-300 ml-4 shrink-0"
+							onclick={() => confirmDelete = key}
+						>Löschen</button>
+					</li>
+				{/each}
+			</ul>
+		{/if}
+
+		<!-- create new -->
+		<div class="flex gap-2">
+			<input
+				type="text"
+				placeholder="Bezeichnung (z.B. iOS Kurzbefehle)"
+				bind:value={newKeyLabel}
+				class="flex-1 rounded border border-border bg-card-bg px-3 py-1.5 text-sm focus:outline-none focus:ring-1 focus:ring-accent"
+				onkeydown={(e) => e.key === 'Enter' && createApiKey()}
+			/>
+			<button
+				class="rounded bg-accent px-3 py-1.5 text-sm font-medium disabled:opacity-50"
+				disabled={!newKeyLabel.trim() || newKeyCreating}
+				onclick={createApiKey}
+			>{newKeyCreating ? '...' : 'Erstellen'}</button>
+		</div>
+	</section>
 </div>
+
+{#if confirmDelete}
+	<ConfirmDialog
+		message="API Key &quot;{confirmDelete.label}&quot; wirklich löschen? Alle Anwendungen, die diesen Key verwenden, verlieren den Zugriff."
+		onconfirm={() => deleteApiKey(confirmDelete!)}
+		oncancel={() => confirmDelete = null}
+	/>
+{/if}
diff --git a/ka-note/server/drizzle/0010_sharp_bishop.sql b/ka-note/server/drizzle/0010_sharp_bishop.sql
new file mode 100644
index 0000000..b4df371
--- /dev/null
+++ b/ka-note/server/drizzle/0010_sharp_bishop.sql
@@ -0,0 +1,13 @@
+CREATE TABLE `api_keys` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`label` text NOT NULL,
+	`key_hash` text NOT NULL,
+	`created_at` integer NOT NULL,
+	`last_used_at` integer,
+	`deleted_at` integer
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `api_keys_key_hash_unique` ON `api_keys` (`key_hash`);--> statement-breakpoint
+CREATE INDEX `api_keys_user_id_idx` ON `api_keys` (`user_id`);--> statement-breakpoint
+CREATE INDEX `api_keys_key_hash_idx` ON `api_keys` (`key_hash`);
\ No newline at end of file
diff --git a/ka-note/server/drizzle/meta/0010_snapshot.json b/ka-note/server/drizzle/meta/0010_snapshot.json
new file mode 100644
index 0000000..ac23230
--- /dev/null
+++ b/ka-note/server/drizzle/meta/0010_snapshot.json
@@ -0,0 +1,1137 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "ca4e7623-eede-4261-a698-3b5fcd27a3f1",
+  "prevId": "e1ead249-7f57-48a8-bd4e-f90988dca719",
+  "tables": {
+    "ai_locks": {
+      "name": "ai_locks",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "api_keys": {
+      "name": "api_keys",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "api_keys_key_hash_unique": {
+          "name": "api_keys_key_hash_unique",
+          "columns": [
+            "key_hash"
+          ],
+          "isUnique": true
+        },
+        "api_keys_user_id_idx": {
+          "name": "api_keys_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "api_keys_key_hash_idx": {
+          "name": "api_keys_key_hash_idx",
+          "columns": [
+            "key_hash"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "contexts": {
+      "name": "contexts",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "meta": {
+          "name": "meta",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "is_favorite": {
+          "name": "is_favorite",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "purged_at": {
+          "name": "purged_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "contexts_updated_at_idx": {
+          "name": "contexts_updated_at_idx",
+          "columns": [
+            "updated_at"
+          ],
+          "isUnique": false
+        },
+        "contexts_user_id_idx": {
+          "name": "contexts_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "contexts_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "contexts_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "history_entries": {
+      "name": "history_entries",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "topic_id": {
+          "name": "topic_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "date": {
+          "name": "date",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "text": {
+          "name": "text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "linked_context_id": {
+          "name": "linked_context_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "done_at": {
+          "name": "done_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "wiedervorlage_date": {
+          "name": "wiedervorlage_date",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "wiedervorlage_resolved_at": {
+          "name": "wiedervorlage_resolved_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "is_private": {
+          "name": "is_private",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "purged_at": {
+          "name": "purged_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "history_entries_updated_at_idx": {
+          "name": "history_entries_updated_at_idx",
+          "columns": [
+            "updated_at"
+          ],
+          "isUnique": false
+        },
+        "history_entries_topic_id_idx": {
+          "name": "history_entries_topic_id_idx",
+          "columns": [
+            "topic_id"
+          ],
+          "isUnique": false
+        },
+        "history_entries_user_id_idx": {
+          "name": "history_entries_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {
+        "history_entries_topic_id_user_id_topics_id_user_id_fk": {
+          "name": "history_entries_topic_id_user_id_topics_id_user_id_fk",
+          "tableFrom": "history_entries",
+          "tableTo": "topics",
+          "columnsFrom": [
+            "topic_id",
+            "user_id"
+          ],
+          "columnsTo": [
+            "id",
+            "user_id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "history_entries_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "history_entries_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "image_blobs": {
+      "name": "image_blobs",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "content_hash": {
+          "name": "content_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "data": {
+          "name": "data",
+          "type": "blob",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "image_blobs_user_id_idx": {
+          "name": "image_blobs_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "image_blobs_content_hash_idx": {
+          "name": "image_blobs_content_hash_idx",
+          "columns": [
+            "content_hash"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "image_blobs_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "image_blobs_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "notebooks": {
+      "name": "notebooks",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "context_id": {
+          "name": "context_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "is_private": {
+          "name": "is_private",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "is_favorite": {
+          "name": "is_favorite",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "purged_at": {
+          "name": "purged_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "notebooks_updated_at_idx": {
+          "name": "notebooks_updated_at_idx",
+          "columns": [
+            "updated_at"
+          ],
+          "isUnique": false
+        },
+        "notebooks_user_id_idx": {
+          "name": "notebooks_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "notebooks_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "notebooks_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "page_notebooks": {
+      "name": "page_notebooks",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "page_id": {
+          "name": "page_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "notebook_id": {
+          "name": "notebook_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "purged_at": {
+          "name": "purged_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "page_notebooks_updated_at_idx": {
+          "name": "page_notebooks_updated_at_idx",
+          "columns": [
+            "updated_at"
+          ],
+          "isUnique": false
+        },
+        "page_notebooks_page_id_idx": {
+          "name": "page_notebooks_page_id_idx",
+          "columns": [
+            "page_id"
+          ],
+          "isUnique": false
+        },
+        "page_notebooks_notebook_id_idx": {
+          "name": "page_notebooks_notebook_id_idx",
+          "columns": [
+            "notebook_id"
+          ],
+          "isUnique": false
+        },
+        "page_notebooks_user_id_idx": {
+          "name": "page_notebooks_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "page_notebooks_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "page_notebooks_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "pages": {
+      "name": "pages",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "''"
+        },
+        "is_private": {
+          "name": "is_private",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "purged_at": {
+          "name": "purged_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "pages_updated_at_idx": {
+          "name": "pages_updated_at_idx",
+          "columns": [
+            "updated_at"
+          ],
+          "isUnique": false
+        },
+        "pages_user_id_idx": {
+          "name": "pages_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "pages_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "pages_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "ratings": {
+      "name": "ratings",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "topic_id": {
+          "name": "topic_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "history_entry_id": {
+          "name": "history_entry_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "person_name": {
+          "name": "person_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "value": {
+          "name": "value",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "comment": {
+          "name": "comment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "purged_at": {
+          "name": "purged_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "ratings_updated_at_idx": {
+          "name": "ratings_updated_at_idx",
+          "columns": [
+            "updated_at"
+          ],
+          "isUnique": false
+        },
+        "ratings_topic_id_idx": {
+          "name": "ratings_topic_id_idx",
+          "columns": [
+            "topic_id"
+          ],
+          "isUnique": false
+        },
+        "ratings_user_id_idx": {
+          "name": "ratings_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {
+        "ratings_topic_id_user_id_topics_id_user_id_fk": {
+          "name": "ratings_topic_id_user_id_topics_id_user_id_fk",
+          "tableFrom": "ratings",
+          "tableTo": "topics",
+          "columnsFrom": [
+            "topic_id",
+            "user_id"
+          ],
+          "columnsTo": [
+            "id",
+            "user_id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "ratings_history_entry_id_user_id_history_entries_id_user_id_fk": {
+          "name": "ratings_history_entry_id_user_id_history_entries_id_user_id_fk",
+          "tableFrom": "ratings",
+          "tableTo": "history_entries",
+          "columnsFrom": [
+            "history_entry_id",
+            "user_id"
+          ],
+          "columnsTo": [
+            "id",
+            "user_id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ratings_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "ratings_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "topics": {
+      "name": "topics",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "context_id": {
+          "name": "context_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'active'"
+        },
+        "snooze_until": {
+          "name": "snooze_until",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "is_new": {
+          "name": "is_new",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "purged_at": {
+          "name": "purged_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {
+        "topics_updated_at_idx": {
+          "name": "topics_updated_at_idx",
+          "columns": [
+            "updated_at"
+          ],
+          "isUnique": false
+        },
+        "topics_context_id_idx": {
+          "name": "topics_context_id_idx",
+          "columns": [
+            "context_id"
+          ],
+          "isUnique": false
+        },
+        "topics_user_id_idx": {
+          "name": "topics_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {
+        "topics_context_id_user_id_contexts_id_user_id_fk": {
+          "name": "topics_context_id_user_id_contexts_id_user_id_fk",
+          "tableFrom": "topics",
+          "tableTo": "contexts",
+          "columnsFrom": [
+            "context_id",
+            "user_id"
+          ],
+          "columnsTo": [
+            "id",
+            "user_id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "topics_id_user_id_pk": {
+          "columns": [
+            "id",
+            "user_id"
+          ],
+          "name": "topics_id_user_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}
\ No newline at end of file
diff --git a/ka-note/server/drizzle/meta/_journal.json b/ka-note/server/drizzle/meta/_journal.json
index f7b4745..12d687a 100644
--- a/ka-note/server/drizzle/meta/_journal.json
+++ b/ka-note/server/drizzle/meta/_journal.json
@@ -71,6 +71,13 @@
       "when": 1771848773587,
       "tag": "0009_fixed_fabian_cortez",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "6",
+      "when": 1771857652883,
+      "tag": "0010_sharp_bishop",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/ka-note/server/src/db/schema.ts b/ka-note/server/src/db/schema.ts
index a5c1dbb..0fa85b9 100644
--- a/ka-note/server/src/db/schema.ts
+++ b/ka-note/server/src/db/schema.ts
@@ -139,6 +139,19 @@ export const aiLocks = sqliteTable('ai_locks', {
   expiresAt: text('expires_at').notNull(),
 });
 
+export const apiKeys = sqliteTable('api_keys', {
+  id: text('id').primaryKey(),
+  userId: text('user_id').notNull(),
+  label: text('label').notNull(),
+  keyHash: text('key_hash').notNull().unique(),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
+  lastUsedAt: integer('last_used_at', { mode: 'timestamp' }),
+  deletedAt: integer('deleted_at', { mode: 'timestamp' }),
+}, (table) => [
+  index('api_keys_user_id_idx').on(table.userId),
+  index('api_keys_key_hash_idx').on(table.keyHash),
+]);
+
 export const ratings = sqliteTable('ratings', {
   id: text('id').notNull(),
   userId: text('user_id').notNull(),
diff --git a/ka-note/server/src/index.ts b/ka-note/server/src/index.ts
index 533e8f0..1dc9553 100644
--- a/ka-note/server/src/index.ts
+++ b/ka-note/server/src/index.ts
@@ -14,6 +14,7 @@ import trashRoutes from './routes/trash.js';
 import adminRoutes from './routes/admin.js';
 import pushRoutes from './routes/push.js';
 import backupRoutes from './routes/backup.js';
+import apiKeyRoutes from './routes/api-keys.js';
 import { runScheduledBackup } from './lib/backup-service.js';
 
 const app = new OpenAPIHono();
@@ -63,6 +64,9 @@ app.route('/api/push', pushRoutes);
 app.use('/api/backup/*', authMiddleware);
 app.route('/api/backup', backupRoutes);
 
+app.use('/api/api-keys/*', authMiddleware);
+app.route('/api/api-keys', apiKeyRoutes);
+
 // OpenAPI spec + Scalar UI
 app.openAPIRegistry.registerComponent('securitySchemes', 'BearerAuth', {
   type: 'http',
diff --git a/ka-note/server/src/middleware/auth.ts b/ka-note/server/src/middleware/auth.ts
index 078ebef..38894cf 100644
--- a/ka-note/server/src/middleware/auth.ts
+++ b/ka-note/server/src/middleware/auth.ts
@@ -1,5 +1,9 @@
 import { createMiddleware } from 'hono/factory';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { createHash } from 'node:crypto';
+import { db } from '../db/connection.js';
+import { apiKeys } from '../db/schema.js';
+import { and, eq, isNull } from 'drizzle-orm';
 
 export interface AuthInfo {
   userId: string;
@@ -35,6 +39,25 @@ export const authMiddleware = createMiddleware<AuthEnv>(async (c, next) => {
   }
 
   const token = authHeader.slice(7);
+
+  // API key path
+  if (token.startsWith('ka_')) {
+    const hash = createHash('sha256').update(token).digest('hex');
+    const [key] = await db
+      .select()
+      .from(apiKeys)
+      .where(and(eq(apiKeys.keyHash, hash), isNull(apiKeys.deletedAt)))
+      .limit(1);
+    if (!key) {
+      return c.json({ error: 'Invalid or revoked API key' }, 401);
+    }
+    c.set('auth', { userId: key.userId, name: key.label, email: '' });
+    // fire-and-forget lastUsedAt update
+    db.update(apiKeys).set({ lastUsedAt: new Date() }).where(eq(apiKeys.id, key.id)).catch(() => {});
+    await next();
+    return;
+  }
+
   try {
     const { payload } = await jwtVerify(token, JWKS!, {
       issuer: [issuerV2, issuerV1],
diff --git a/ka-note/server/src/routes/api-keys.ts b/ka-note/server/src/routes/api-keys.ts
new file mode 100644
index 0000000..53209ad
--- /dev/null
+++ b/ka-note/server/src/routes/api-keys.ts
@@ -0,0 +1,62 @@
+import { Hono } from 'hono';
+import { randomBytes, createHash } from 'node:crypto';
+import { db } from '../db/connection.js';
+import { apiKeys } from '../db/schema.js';
+import { and, eq, isNull } from 'drizzle-orm';
+import type { AuthEnv } from '../middleware/auth.js';
+
+const router = new Hono<AuthEnv>();
+
+router.get('/', async (c) => {
+  const { userId } = c.get('auth');
+  const rows = await db
+    .select({
+      id: apiKeys.id,
+      label: apiKeys.label,
+      createdAt: apiKeys.createdAt,
+      lastUsedAt: apiKeys.lastUsedAt,
+    })
+    .from(apiKeys)
+    .where(and(eq(apiKeys.userId, userId), isNull(apiKeys.deletedAt)));
+  return c.json(rows);
+});
+
+router.post('/', async (c) => {
+  const { userId } = c.get('auth');
+  const body = await c.req.json<{ label: string }>();
+  if (!body.label?.trim()) {
+    return c.json({ error: 'label required' }, 400);
+  }
+
+  const rawKey = 'ka_' + randomBytes(32).toString('base64url');
+  const keyHash = createHash('sha256').update(rawKey).digest('hex');
+  const id = randomBytes(16).toString('hex');
+  const now = new Date();
+
+  await db.insert(apiKeys).values({
+    id,
+    userId,
+    label: body.label.trim(),
+    keyHash,
+    createdAt: now,
+  });
+
+  return c.json({ id, label: body.label.trim(), createdAt: now, lastUsedAt: null, key: rawKey }, 201);
+});
+
+router.delete('/:id', async (c) => {
+  const { userId } = c.get('auth');
+  const id = c.req.param('id');
+
+  const result = await db
+    .update(apiKeys)
+    .set({ deletedAt: new Date() })
+    .where(and(eq(apiKeys.id, id), eq(apiKeys.userId, userId), isNull(apiKeys.deletedAt)));
+
+  if (result.rowsAffected === 0) {
+    return c.json({ error: 'Not found' }, 404);
+  }
+  return c.body(null, 204);
+});
+
+export default router;