@willyim/idp 0.3.0 → 0.3.1

package/README.md

@@ -358,9 +358,14 @@ const { token } = await api.request("post", "/api/v1/admin-keys", {
 //   Authorization: Bearer wim_…
 ```
 
-The IdP's static `ADMIN_API_TOKEN` still works and still grants superadmin, but
-it is break-glass only: one shared secret, no name, no expiry, and no way to
-revoke it short of a redeploy.
+There is no static superadmin secret: every bearer the IdP accepts is a key row
+it issued, so every superadmin action names a revocable credential.
+
+**Break-glass.** If every admin key is lost, recover by writing one bootstrap
+key straight into D1 — insert an `api_key` row with `application_id` NULL and
+`key_hash` set to the SHA-256 hex digest of a token you generate — then use it
+to mint a real key via `POST /api/v1/admin-keys` and revoke the bootstrap row
+through `DELETE /api/v1/admin-keys/{id}`.
 
 The OIDC endpoints are not in that document and never will be: they are
 standards-defined and discovered at runtime from `.well-known`.

package/dist/src/api.d.ts

@@ -42,7 +42,7 @@ export type RequestOptions<P extends string, O> = PathParams<P> & RequestBody<O>
 export type ManagementApiOptions = {
     /** IdP origin — the API lives at the root, not under the `/auth` basepath. */
     baseUrl: string;
-    /** Superadmin `ADMIN_API_TOKEN` or a scoped `wim_…` key. */
+    /** An IdP-level admin key or a per-app scoped `wim_…` key. */
     token: string;
     fetch?: typeof fetch;
 };

package/dist/src/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAG5B,OAAO,EAEL,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAA;AAGhC,MAAM,MAAM,MAAM,GAAG,UAAU,CAAA;AAC/B,YAAY,EAAE,QAAQ,EAAE,CAAA;AAExB,6EAA6E;AAC7E,KAAK,UAAU,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACnE;IAAE,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,CAAA;AAEjD,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;CAAE,GACpB;IAAE,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAExB,mEAAmE;AACnE,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAA;CAAE,GACzE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GACX,KAAK,CAAA;AAET,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,GAC7D,WAAW,CAAC,CAAC,CAAC,GAAG;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAA;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB,CAAA;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB;YAK/C,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,UAC3C,CAAC,QACH,CAAC,SACD,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;EAuC9C;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAG5B,OAAO,EAEL,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAA;AAGhC,MAAM,MAAM,MAAM,GAAG,UAAU,CAAA;AAC/B,YAAY,EAAE,QAAQ,EAAE,CAAA;AAExB,6EAA6E;AAC7E,KAAK,UAAU,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACnE;IAAE,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,CAAA;AAEjD,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;CAAE,GACpB;IAAE,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAExB,mEAAmE;AACnE,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAA;CAAE,GACzE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GACX,KAAK,CAAA;AAET,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,GAC7D,WAAW,CAAC,CAAC,CAAC,GAAG;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAA;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAA;IACf,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB,CAAA;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB;YAK/C,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,UAC3C,CAAC,QACH,CAAC,SACD,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;EAuC9C;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA"}

package/dist/src/schemas/openapi.js

@@ -16,7 +16,7 @@ import { lookup, operations } from "./operations.js";
  */
 const json = (schema) => z.toJSONSchema(schema);
 const jsonInput = (schema) => z.toJSONSchema(schema, { io: "input" });
-const DESCRIPTION = "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of token: the superadmin `ADMIN_API_TOKEN` (every app) and per-app **scoped API keys** minted in the admin console (one app, a fixed permission set). The cross-app endpoints below require the superadmin token.";
+const DESCRIPTION = "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of bearer, both `wim_` keys: IdP-level **admin keys** (every permission on every app, minted at `/api/v1/admin-keys`) and per-app **scoped keys** minted in the admin console (one app, a fixed permission set). The cross-app endpoints below require an admin key.";
 function pathParamNames(path) {
     return [...path.matchAll(/\{([^}]+)\}/g)].map((match) => match[1]);
 }
@@ -45,8 +45,8 @@ function operationObject(method, path, def) {
         summary: def.summary,
         description: def.description ??
             (scoped
-                ? `Requires \`${def.permission}\` on the path app (or the superadmin token).`
-                : "Requires the superadmin token."),
+                ? `Requires \`${def.permission}\` on the path app (or an admin key).`
+                : "Requires an admin key."),
         security: [{ bearerAuth: [] }],
         ...(parameters.length ? { parameters } : {}),
         ...(def.input
@@ -102,7 +102,7 @@ export function buildOpenApiDocument(input) {
                 bearerAuth: {
                     type: "http",
                     scheme: "bearer",
-                    description: "Superadmin ADMIN_API_TOKEN or a scoped API key (wim_…).",
+                    description: "An IdP-level admin key or a per-app scoped key (wim_…).",
                 },
             },
         },

package/dist/src/schemas/operations.d.ts

@@ -51,7 +51,7 @@ export declare const operations: {
     };
     readonly "post /api/v1/applications": {
         readonly summary: "Register an application (client secret returned once)";
-        readonly description: "Requires the superadmin token. Creating an application is an IdP-level act — there is no app to scope a permission to yet.";
+        readonly description: "Requires an admin key. Creating an application is an IdP-level act — there is no app to scope a permission to yet.";
         readonly input: z.ZodObject<{
             name: z.ZodString;
             app: z.ZodString;
@@ -174,7 +174,7 @@ export declare const operations: {
     };
     readonly "post /api/v1/apps/{app}/keys": {
         readonly summary: "Mint a scoped management API key (plaintext returned once)";
-        readonly description: "Requires `apikey:create` on the path app (or the superadmin token). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.";
+        readonly description: "Requires `apikey:create` on the path app (or an admin key). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.";
         readonly permission: "apikey:create";
         readonly params: {
             readonly app: "Application key (oauth_client.metadata.app).";
@@ -205,7 +205,7 @@ export declare const operations: {
     };
     readonly "get /api/v1/admin-keys": {
         readonly summary: "List IdP-level admin keys (never the hashes)";
-        readonly description: "Requires the superadmin token or an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.";
+        readonly description: "Requires an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.";
         readonly successCode: "200";
         readonly success: z.ZodObject<{
             keys: z.ZodArray<z.ZodObject<{
@@ -226,7 +226,7 @@ export declare const operations: {
     };
     readonly "post /api/v1/admin-keys": {
         readonly summary: "Mint an IdP-level admin key (plaintext returned once)";
-        readonly description: "Requires the superadmin token or an admin key. Mint one per agent: unlike the static ADMIN_API_TOKEN, an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log.";
+        readonly description: "Requires an admin key. Mint one per agent: an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log, so every superadmin action is attributable.";
         readonly input: z.ZodObject<{
             name: z.ZodString;
             expiresAt: z.ZodOptional<z.ZodISODateTime>;

package/dist/src/schemas/operations.js

@@ -19,7 +19,7 @@ export const operations = {
     },
     "post /api/v1/applications": {
         summary: "Register an application (client secret returned once)",
-        description: "Requires the superadmin token. Creating an application is an IdP-level act — there is no app to scope a permission to yet.",
+        description: "Requires an admin key. Creating an application is an IdP-level act — there is no app to scope a permission to yet.",
         input: CreateApplicationInput,
         successCode: "201",
         success: ApplicationCreatedSchema,
@@ -75,7 +75,7 @@ export const operations = {
     },
     "post /api/v1/apps/{app}/keys": {
         summary: "Mint a scoped management API key (plaintext returned once)",
-        description: "Requires `apikey:create` on the path app (or the superadmin token). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.",
+        description: "Requires `apikey:create` on the path app (or an admin key). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.",
         permission: "apikey:create",
         params: APP_PARAM,
         input: CreateApiKeyInput,
@@ -92,13 +92,13 @@ export const operations = {
     },
     "get /api/v1/admin-keys": {
         summary: "List IdP-level admin keys (never the hashes)",
-        description: "Requires the superadmin token or an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.",
+        description: "Requires an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.",
         successCode: "200",
         success: AdminKeyListSchema,
     },
     "post /api/v1/admin-keys": {
         summary: "Mint an IdP-level admin key (plaintext returned once)",
-        description: "Requires the superadmin token or an admin key. Mint one per agent: unlike the static ADMIN_API_TOKEN, an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log.",
+        description: "Requires an admin key. Mint one per agent: an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log, so every superadmin action is attributable.",
         input: CreateAdminKeyInput,
         successCode: "201",
         success: AdminKeyCreatedSchema,

package/openapi/idp-api.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "willy.im IdP — Management API",
     "version": "1.0.0",
-    "description": "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of token: the superadmin `ADMIN_API_TOKEN` (every app) and per-app **scoped API keys** minted in the admin console (one app, a fixed permission set). The cross-app endpoints below require the superadmin token."
+    "description": "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of bearer, both `wim_` keys: IdP-level **admin keys** (every permission on every app, minted at `/api/v1/admin-keys`) and per-app **scoped keys** minted in the admin console (one app, a fixed permission set). The cross-app endpoints below require an admin key."
   },
   "servers": [
     {
@@ -15,7 +15,7 @@
       "bearerAuth": {
         "type": "http",
         "scheme": "bearer",
-        "description": "Superadmin ADMIN_API_TOKEN or a scoped API key (wim_…)."
+        "description": "An IdP-level admin key or a per-app scoped key (wim_…)."
       }
     }
   },
@@ -23,7 +23,7 @@
     "/api/v1/applications": {
       "get": {
         "summary": "List registered applications",
-        "description": "Requires the superadmin token.",
+        "description": "Requires an admin key.",
         "security": [
           {
             "bearerAuth": []
@@ -121,7 +121,7 @@
       },
       "post": {
         "summary": "Register an application (client secret returned once)",
-        "description": "Requires the superadmin token. Creating an application is an IdP-level act — there is no app to scope a permission to yet.",
+        "description": "Requires an admin key. Creating an application is an IdP-level act — there is no app to scope a permission to yet.",
         "security": [
           {
             "bearerAuth": []
@@ -222,7 +222,7 @@
     "/api/v1/applications/{clientId}": {
       "get": {
         "summary": "Get one application",
-        "description": "Requires `app:read` on the path app (or the superadmin token).",
+        "description": "Requires `app:read` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -325,7 +325,7 @@
       },
       "patch": {
         "summary": "Update an application",
-        "description": "Requires `app:update` on the path app (or the superadmin token).",
+        "description": "Requires `app:update` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -465,7 +465,7 @@
       },
       "delete": {
         "summary": "Deregister an application",
-        "description": "Requires `app:delete` on the path app (or the superadmin token).",
+        "description": "Requires `app:delete` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -525,7 +525,7 @@
     "/api/v1/applications/{clientId}/rotate-secret": {
       "post": {
         "summary": "Rotate the client secret (returned once; the old one stops working)",
-        "description": "Requires `app:update` on the path app (or the superadmin token).",
+        "description": "Requires `app:update` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -585,7 +585,7 @@
     "/api/v1/apps/{app}/permissions": {
       "put": {
         "summary": "Replace the app's product-permission catalog",
-        "description": "Requires `app:update` on the path app (or the superadmin token).",
+        "description": "Requires `app:update` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -673,7 +673,7 @@
     "/api/v1/apps/{app}/keys": {
       "get": {
         "summary": "List scoped management API keys (never the hashes)",
-        "description": "Requires `apikey:read` on the path app (or the superadmin token).",
+        "description": "Requires `apikey:read` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -796,7 +796,7 @@
       },
       "post": {
         "summary": "Mint a scoped management API key (plaintext returned once)",
-        "description": "Requires `apikey:create` on the path app (or the superadmin token). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.",
+        "description": "Requires `apikey:create` on the path app (or an admin key). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.",
         "security": [
           {
             "bearerAuth": []
@@ -899,7 +899,7 @@
     "/api/v1/apps/{app}/keys/{id}": {
       "delete": {
         "summary": "Revoke a scoped management API key (idempotent)",
-        "description": "Requires `apikey:revoke` on the path app (or the superadmin token).",
+        "description": "Requires `apikey:revoke` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -967,7 +967,7 @@
     "/api/v1/admin-keys": {
       "get": {
         "summary": "List IdP-level admin keys (never the hashes)",
-        "description": "Requires the superadmin token or an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.",
+        "description": "Requires an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.",
         "security": [
           {
             "bearerAuth": []
@@ -1068,7 +1068,7 @@
       },
       "post": {
         "summary": "Mint an IdP-level admin key (plaintext returned once)",
-        "description": "Requires the superadmin token or an admin key. Mint one per agent: unlike the static ADMIN_API_TOKEN, an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log.",
+        "description": "Requires an admin key. Mint one per agent: an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log, so every superadmin action is attributable.",
         "security": [
           {
             "bearerAuth": []
@@ -1206,7 +1206,7 @@
     "/api/v1/users": {
       "get": {
         "summary": "List users",
-        "description": "Requires the superadmin token.",
+        "description": "Requires an admin key.",
         "security": [
           {
             "bearerAuth": []
@@ -1277,7 +1277,7 @@
     "/api/v1/workspaces": {
       "get": {
         "summary": "List workspaces",
-        "description": "Requires the superadmin token.",
+        "description": "Requires an admin key.",
         "security": [
           {
             "bearerAuth": []
@@ -1348,7 +1348,7 @@
     "/api/v1/apps/{app}/members": {
       "get": {
         "summary": "List app members",
-        "description": "Requires `member:read` on the path app (or the superadmin token).",
+        "description": "Requires `member:read` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -1438,7 +1438,7 @@
       },
       "post": {
         "summary": "Add or invite a member",
-        "description": "Requires `member:invite` on the path app (or the superadmin token).",
+        "description": "Requires `member:invite` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -1537,7 +1537,7 @@
     "/api/v1/apps/{app}/members/{userId}": {
       "patch": {
         "summary": "Update a member's role + permissions",
-        "description": "Requires `member:manage` on the path app (or the superadmin token).",
+        "description": "Requires `member:manage` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -1633,7 +1633,7 @@
       },
       "delete": {
         "summary": "Remove a member",
-        "description": "Requires `member:manage` on the path app (or the superadmin token).",
+        "description": "Requires `member:manage` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -1698,7 +1698,7 @@
     "/api/v1/apps/{app}/workspaces": {
       "get": {
         "summary": "List app workspaces",
-        "description": "Requires `workspace:read` on the path app (or the superadmin token).",
+        "description": "Requires `workspace:read` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -1781,7 +1781,7 @@
       },
       "post": {
         "summary": "Create a workspace",
-        "description": "Requires `workspace:create` on the path app (or the superadmin token).",
+        "description": "Requires `workspace:create` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -1874,7 +1874,7 @@
     "/api/v1/apps/{app}/user-keys": {
       "get": {
         "summary": "List end-user API keys",
-        "description": "Requires `userkey:read` on the path app (or the superadmin token).",
+        "description": "Requires `userkey:read` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -2018,7 +2018,7 @@
       },
       "post": {
         "summary": "Mint an end-user API key (plaintext returned once)",
-        "description": "Requires `userkey:create` on the path app (or the superadmin token).",
+        "description": "Requires `userkey:create` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -2128,7 +2128,7 @@
     "/api/v1/apps/{app}/user-keys/validate": {
       "post": {
         "summary": "Validate a presented end-user key (200 + valid discriminator)",
-        "description": "Requires `userkey:validate` on the path app (or the superadmin token).",
+        "description": "Requires `userkey:validate` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -2264,7 +2264,7 @@
     "/api/v1/apps/{app}/user-keys/{id}": {
       "delete": {
         "summary": "Revoke an end-user API key (idempotent)",
-        "description": "Requires `userkey:revoke` on the path app (or the superadmin token).",
+        "description": "Requires `userkey:revoke` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []
@@ -2329,7 +2329,7 @@
     "/api/v1/apps/{app}/audit": {
       "get": {
         "summary": "List recent audit entries",
-        "description": "Requires `audit:read` on the path app (or the superadmin token).",
+        "description": "Requires `audit:read` on the path app (or an admin key).",
         "security": [
           {
             "bearerAuth": []

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@willyim/idp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Login for apps that don't own identity \u2014 OIDC client, server sessions, and react-router guards against the willy.im IdP",
   "type": "module",
   "main": "./dist/src/index.js",