# PlatPhorm Keys
> Enterprise-grade API key management with AES-256-GCM encryption, comprehensive audit logging, rate limiting, and OpenTelemetry observability for the PlatPhorm News Network.

## Overview
PlatPhorm Keys is the canonical public-safe API key issuer and future PLATPHORM_API_KEY lifecycle manager for the PlatPhormNews web mesh.

## Features
- Public-safe, bounded self-service PLATPHORM_API_KEY provisioning
- AES-256-GCM encryption plus key hashing for stored key material
- Automatic client UUID and fingerprint generation
- OpenTelemetry observability with trace IDs
- Comprehensive audit logging
- Rate limiting and scope-based access control
- One-time generated secret reveal

## API Endpoints
- POST /api/v1/keys/provision - Self-service key creation (no auth required)
- GET /api/v1/keys - List keys (future protected / requires PLATPHORM_API_KEY when enabled)
- GET /api/v1/keys/:id - Get key details
- POST /api/v1/keys/:id/rotate - Rotate a key
- DELETE /api/v1/keys/:id - Revoke a key
- POST /api/v1/keys/validate - Validate a key
- GET /api/v1/health - Health check
- GET /api/v1/telemetry - Public-safe telemetry summary, protected details
- GET /api/docs - OpenAPI specification
- POST /api/mcp - JSON-RPC 2.0 MCP surface

## Authentication
Protected requests accept:
- Authorization: Bearer $PLATPHORM_API_KEY
- X-PlatPhorm-API-Key: $PLATPHORM_API_KEY

## Rate Limits
- Key provisioning: 5 per hour per client
- Key operations: 100 per minute per tenant

## Counts
- Public routes: 12
- Scopes: 11
- MCP tools: 18
- Version: 1.0.0-phase1

## Links
- API Docs: https://keys.platphormnews.com/docs
- OpenAPI: https://keys.platphormnews.com/openapi.yaml
- Health: https://keys.platphormnews.com/api/v1/health
- Network: https://platphormnews.com