webgate 0.2.0__tar.gz → 0.2.1__tar.gz

{webgate-0.2.0 → webgate-0.2.1}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## v0.2.1 (2026-04-15)
+
+### Features
+
+- **Reverse proxy sub-path support** -- webgate can now be served behind a reverse proxy at a URL prefix (e.g. `https://example.com/webgate/`). Previously the frontend used absolute `/api/...` paths that broke under any prefix.
+
+### Details
+
+- New config setting: `WEBGATE_ROOT_PATH` (default `""`), passed to FastAPI's `root_path` for correct OpenAPI URLs behind proxies
+- Frontend derives the path prefix at runtime from `window.location.pathname` and prepends it to all REST calls and the terminal WebSocket URL
+- README documents nginx, Apache, and Traefik reverse-proxy configurations for sub-path deployments
+- The proxy must forward the prefix unchanged (do not strip it) -- webgate handles the prefix natively
+
+---
+
 ## v0.2.0 (2026-04-09)
 
 ### Features

{webgate-0.2.0 → webgate-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webgate
-Version: 0.2.0
+Version: 0.2.1
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -34,8 +34,10 @@ Requires-Dist: fastapi>=0.115.0
 Requires-Dist: passlib[bcrypt]>=1.7.4
 Requires-Dist: pydantic-settings>=2.7.0
 Requires-Dist: pydantic>=2.10.0
+Requires-Dist: pyotp>=2.9.0
 Requires-Dist: python-jose[cryptography]>=3.3.0
 Requires-Dist: python-multipart>=0.0.18
+Requires-Dist: qrcode[pil]>=8.2
 Requires-Dist: slowapi>=0.1.9
 Requires-Dist: sqlalchemy>=2.0.36
 Requires-Dist: uvicorn[standard]>=0.34.0
@@ -233,6 +235,9 @@ flowchart TB
 ### Audit Log
 ![Audit](docs/screenshots/audit.png)
 
+### Light Theme
+![Light Theme](docs/screenshots/light-theme.png)
+
 ## Quick Start
 
 ### Docker (recommended)
@@ -443,6 +448,7 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_SECRET_KEY` | `change-me-in-production` | JWT signing + Fernet encryption key |
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
+| `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |
@@ -499,6 +505,105 @@ webgate.example.com {
 }
 ```
 
+### Reverse proxy at a sub-path (e.g. `https://example.com/webgate/`)
+
+When webgate is exposed behind an existing site under a URL prefix, set `WEBGATE_ROOT_PATH` so FastAPI and the frontend both build URLs with the prefix. The frontend derives the prefix automatically from `window.location.pathname`, but `WEBGATE_ROOT_PATH` is still needed on the backend for OpenAPI URLs.
+
+**Docker Compose:**
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_SECRET_KEY: "${WEBGATE_SECRET_KEY}"
+      WEBGATE_ROOT_PATH: "/webgate"
+```
+
+> **Important:** the reverse proxy must **forward the prefix unchanged** (not strip it). Webgate receives requests as `/webgate/api/...` and handles them natively — do not rewrite them to `/api/...`.
+
+#### nginx
+
+```nginx
+server {
+    listen 443 ssl http2;
+    server_name example.com;
+
+    ssl_certificate     /etc/ssl/certs/example.com.crt;
+    ssl_certificate_key /etc/ssl/private/example.com.key;
+
+    # WebSocket (xterm.js terminal) -- must come before the generic location
+    location /webgate/api/ws/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host       $host;
+        proxy_read_timeout 86400s;   # keep long-lived SSH sessions alive
+        proxy_send_timeout 86400s;
+    }
+
+    location /webgate/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Prefix /webgate;
+        client_max_body_size 100m;       # match WEBGATE_MAX_UPLOAD_SIZE
+    }
+}
+```
+
+#### Apache 2.4
+
+```apache
+# Required modules: proxy proxy_http proxy_wstunnel headers rewrite ssl
+# sudo a2enmod proxy proxy_http proxy_wstunnel headers rewrite
+
+<VirtualHost *:443>
+    ServerName example.com
+
+    SSLEngine on
+    SSLCertificateFile    /etc/ssl/certs/example.com.crt
+    SSLCertificateKeyFile /etc/ssl/private/example.com.key
+
+    ProxyPreserveHost On
+    RequestHeader set X-Forwarded-Proto  "https"
+    RequestHeader set X-Forwarded-Prefix "/webgate"
+
+    # Redirect /webgate -> /webgate/ (trailing slash)
+    RewriteEngine On
+    RewriteRule ^/webgate$ /webgate/ [R=301,L]
+
+    # WebSocket (xterm.js terminal) -- MUST come before the HTTP ProxyPass
+    ProxyPass        /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+    ProxyPassReverse /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+
+    # HTTP
+    ProxyPass        /webgate/  http://127.0.0.1:8443/webgate/
+    ProxyPassReverse /webgate/  http://127.0.0.1:8443/webgate/
+</VirtualHost>
+```
+
+#### Traefik (labels)
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_ROOT_PATH: "/webgate"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.webgate.rule=Host(`example.com`) && PathPrefix(`/webgate`)"
+      - "traefik.http.routers.webgate.entrypoints=websecure"
+      - "traefik.http.routers.webgate.tls=true"
+      - "traefik.http.services.webgate.loadbalancer.server.port=8443"
+```
+
+Traefik forwards the full path by default, so no extra middleware is needed. Long WebSocket timeouts can be tuned via `forwardingTimeouts` in the Traefik static config.
+
 ### Useful Commands
 
 ```bash

{webgate-0.2.0 → webgate-0.2.1}/README.md

@@ -189,6 +189,9 @@ flowchart TB
 ### Audit Log
 ![Audit](docs/screenshots/audit.png)
 
+### Light Theme
+![Light Theme](docs/screenshots/light-theme.png)
+
 ## Quick Start
 
 ### Docker (recommended)
@@ -399,6 +402,7 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_SECRET_KEY` | `change-me-in-production` | JWT signing + Fernet encryption key |
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
+| `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |
@@ -455,6 +459,105 @@ webgate.example.com {
 }
 ```
 
+### Reverse proxy at a sub-path (e.g. `https://example.com/webgate/`)
+
+When webgate is exposed behind an existing site under a URL prefix, set `WEBGATE_ROOT_PATH` so FastAPI and the frontend both build URLs with the prefix. The frontend derives the prefix automatically from `window.location.pathname`, but `WEBGATE_ROOT_PATH` is still needed on the backend for OpenAPI URLs.
+
+**Docker Compose:**
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_SECRET_KEY: "${WEBGATE_SECRET_KEY}"
+      WEBGATE_ROOT_PATH: "/webgate"
+```
+
+> **Important:** the reverse proxy must **forward the prefix unchanged** (not strip it). Webgate receives requests as `/webgate/api/...` and handles them natively — do not rewrite them to `/api/...`.
+
+#### nginx
+
+```nginx
+server {
+    listen 443 ssl http2;
+    server_name example.com;
+
+    ssl_certificate     /etc/ssl/certs/example.com.crt;
+    ssl_certificate_key /etc/ssl/private/example.com.key;
+
+    # WebSocket (xterm.js terminal) -- must come before the generic location
+    location /webgate/api/ws/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host       $host;
+        proxy_read_timeout 86400s;   # keep long-lived SSH sessions alive
+        proxy_send_timeout 86400s;
+    }
+
+    location /webgate/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Prefix /webgate;
+        client_max_body_size 100m;       # match WEBGATE_MAX_UPLOAD_SIZE
+    }
+}
+```
+
+#### Apache 2.4
+
+```apache
+# Required modules: proxy proxy_http proxy_wstunnel headers rewrite ssl
+# sudo a2enmod proxy proxy_http proxy_wstunnel headers rewrite
+
+<VirtualHost *:443>
+    ServerName example.com
+
+    SSLEngine on
+    SSLCertificateFile    /etc/ssl/certs/example.com.crt
+    SSLCertificateKeyFile /etc/ssl/private/example.com.key
+
+    ProxyPreserveHost On
+    RequestHeader set X-Forwarded-Proto  "https"
+    RequestHeader set X-Forwarded-Prefix "/webgate"
+
+    # Redirect /webgate -> /webgate/ (trailing slash)
+    RewriteEngine On
+    RewriteRule ^/webgate$ /webgate/ [R=301,L]
+
+    # WebSocket (xterm.js terminal) -- MUST come before the HTTP ProxyPass
+    ProxyPass        /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+    ProxyPassReverse /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+
+    # HTTP
+    ProxyPass        /webgate/  http://127.0.0.1:8443/webgate/
+    ProxyPassReverse /webgate/  http://127.0.0.1:8443/webgate/
+</VirtualHost>
+```
+
+#### Traefik (labels)
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_ROOT_PATH: "/webgate"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.webgate.rule=Host(`example.com`) && PathPrefix(`/webgate`)"
+      - "traefik.http.routers.webgate.entrypoints=websecure"
+      - "traefik.http.routers.webgate.tls=true"
+      - "traefik.http.services.webgate.loadbalancer.server.port=8443"
+```
+
+Traefik forwards the full path by default, so no extra middleware is needed. Long WebSocket timeouts can be tuned via `forwardingTimeouts` in the Traefik static config.
+
 ### Useful Commands
 
 ```bash

{webgate-0.2.0 → webgate-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "0.2.0"
+version = "0.2.1"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"
@@ -38,6 +38,8 @@ dependencies = [
     "cryptography>=44.0.0",
     "websockets>=14.0",
     "slowapi>=0.1.9",
+    "pyotp>=2.9.0",
+    "qrcode[pil]>=8.2",
 ]
 
 [project.urls]

{webgate-0.2.0 → webgate-0.2.1}/src/webgate/app.py

@@ -33,7 +33,12 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None]:
 
 
 def create_app() -> FastAPI:
-    app = FastAPI(title="webgate", version="0.1.0", lifespan=lifespan)
+    app = FastAPI(
+        title="webgate",
+        version="0.1.0",
+        lifespan=lifespan,
+        root_path=settings.root_path,
+    )
     app.state.limiter = limiter
     app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 

{webgate-0.2.0 → webgate-0.2.1}/src/webgate/auth/models.py

@@ -2,7 +2,7 @@ import json
 from datetime import datetime
 
 from pydantic import BaseModel, field_validator
-from sqlalchemy import Boolean, DateTime, String, Text, func
+from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column
 
 from webgate.db.engine import Base
@@ -17,6 +17,20 @@ class User(Base):
     is_admin: Mapped[bool] = mapped_column(Boolean, default=False)
     must_change_password: Mapped[bool] = mapped_column(Boolean, default=False)
     allowed_groups: Mapped[str] = mapped_column(Text, default="[]")  # JSON array of group names
+    totp_secret: Mapped[str] = mapped_column(String(255), default="")
+    totp_enabled: Mapped[bool] = mapped_column(Boolean, default=False)
+    created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
+
+
+class ApiKey(Base):
+    __tablename__ = "api_keys"
+
+    id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
+    user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
+    name: Mapped[str] = mapped_column(String(255))
+    key_hash: Mapped[str] = mapped_column(String(255))
+    key_prefix: Mapped[str] = mapped_column(String(10))
+    last_used_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
     created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
 
 
@@ -28,6 +42,7 @@ class UserCreate(BaseModel):
 class UserLogin(BaseModel):
     username: str
     password: str
+    totp_code: str = ""
 
 
 class UserOut(BaseModel):
@@ -35,6 +50,7 @@ class UserOut(BaseModel):
     username: str
     is_admin: bool
     must_change_password: bool = False
+    totp_enabled: bool = False
     allowed_groups: list[str] = []
 
     model_config = {"from_attributes": True}
@@ -65,6 +81,48 @@ class ChangePassword(BaseModel):
     new_password: str
 
 
+class TotpSetupOut(BaseModel):
+    secret: str
+    qr_uri: str
+    qr_base64: str
+
+
+class TotpVerifyIn(BaseModel):
+    code: str
+
+
+class TotpStatusOut(BaseModel):
+    enabled: bool
+
+
+class LoginOut(BaseModel):
+    access_token: str = ""
+    token_type: str = "bearer"
+    requires_2fa: bool = False
+    temp_token: str = ""
+
+
 class TokenOut(BaseModel):
     access_token: str
     token_type: str = "bearer"
+
+
+class ApiKeyCreate(BaseModel):
+    name: str
+
+
+class ApiKeyOut(BaseModel):
+    id: int
+    name: str
+    key_prefix: str
+    last_used_at: datetime | None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class ApiKeyCreated(BaseModel):
+    id: int
+    name: str
+    key: str
+    key_prefix: str

{webgate-0.2.0 → webgate-0.2.1}/src/webgate/auth/routes.py

@@ -11,24 +11,37 @@ limiter = Limiter(key_func=get_remote_address)
 from webgate.audit.models import AuditOut
 from webgate.audit.service import get_audit_log, log_action
 from webgate.auth.models import (
+    ApiKeyCreate,
+    ApiKeyCreated,
+    ApiKeyOut,
     ChangePassword,
-    TokenOut,
+    LoginOut,
+    TotpSetupOut,
+    TotpStatusOut,
+    TotpVerifyIn,
     UserLogin,
     UserManage,
     UserOut,
     UserUpdateGroups,
 )
 from webgate.auth.service import (
+    authenticate_api_key,
     create_access_token,
+    create_api_key,
     create_user,
     decode_access_token,
+    delete_api_key,
     delete_user,
+    generate_totp_secret,
+    get_api_keys,
+    get_totp_uri,
     get_user_by_id,
     get_user_by_username,
     list_users,
     update_user_groups,
     update_user_password,
     verify_password,
+    verify_totp,
 )
 from webgate.db.engine import get_session
 
@@ -40,7 +53,17 @@ AuthDep = Annotated[HTTPAuthorizationCredentials, Depends(security)]
 
 
 async def get_current_user(credentials: AuthDep, session: SessionDep) -> UserOut:
-    payload = decode_access_token(credentials.credentials)
+    token = credentials.credentials
+
+    # Check if it's an API key (starts with "wg_")
+    if token.startswith("wg_"):
+        user = await authenticate_api_key(session, token)
+        if not user:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
+        return UserOut.model_validate(user)
+
+    # Otherwise treat as JWT
+    payload = decode_access_token(token)
     if payload is None:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
     user_id = payload.get("sub")
@@ -60,17 +83,35 @@ def _require_admin(user: UserOut) -> None:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin only")
 
 
-@router.post("/login", response_model=TokenOut)
+@router.post("/login", response_model=LoginOut)
 @limiter.limit("10/minute")
-async def login(request: Request, body: UserLogin, session: SessionDep) -> TokenOut:
+async def login(request: Request, body: UserLogin, session: SessionDep) -> LoginOut:
     user = await get_user_by_username(session, body.username)
     if not user or not verify_password(body.password, user.hashed_password):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials"
         )
+    # Check if 2FA is enabled
+    if user.totp_enabled and user.totp_secret:
+        if not body.totp_code:
+            # Issue a short-lived temp token for 2FA verification
+            temp_token = create_access_token(
+                {"sub": str(user.id), "pending_2fa": True, "exp_minutes": 2}
+            )
+            return LoginOut(requires_2fa=True, temp_token=temp_token)
+        # Verify the TOTP code
+        if not verify_totp(user.totp_secret, body.totp_code):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid 2FA code"
+            )
     token = create_access_token({"sub": str(user.id), "username": user.username})
-    await log_action(user.id, user.username, "login", ip_address=request.client.host if request.client else "")
-    return TokenOut(access_token=token)
+    await log_action(
+        user.id,
+        user.username,
+        "login",
+        ip_address=request.client.host if request.client else "",
+    )
+    return LoginOut(access_token=token)
 
 
 @router.get("/me", response_model=UserOut)
@@ -162,6 +203,112 @@ async def remove_user(
     await delete_user(session, user)
 
 
+@router.post("/totp/setup", response_model=TotpSetupOut)
+async def totp_setup(session: SessionDep, current_user: CurrentUserDep) -> TotpSetupOut:
+    import base64
+    import io
+
+    import qrcode
+
+    user = await get_user_by_id(session, current_user.id)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    secret = generate_totp_secret()
+    user.totp_secret = secret
+    await session.commit()
+    uri = get_totp_uri(secret, user.username)
+    qr = qrcode.make(uri)
+    buf = io.BytesIO()
+    qr.save(buf, format="PNG")
+    qr_b64 = base64.b64encode(buf.getvalue()).decode()
+    return TotpSetupOut(secret=secret, qr_uri=uri, qr_base64=f"data:image/png;base64,{qr_b64}")
+
+
+@router.post("/totp/verify", response_model=TotpStatusOut)
+async def totp_verify(
+    body: TotpVerifyIn, session: SessionDep, current_user: CurrentUserDep
+) -> TotpStatusOut:
+    user = await get_user_by_id(session, current_user.id)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    if not user.totp_secret:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="Run TOTP setup first"
+        )
+    if not verify_totp(user.totp_secret, body.code):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid TOTP code")
+    user.totp_enabled = True
+    await session.commit()
+    return TotpStatusOut(enabled=True)
+
+
+@router.post("/totp/disable", response_model=TotpStatusOut)
+async def totp_disable(
+    body: TotpVerifyIn, session: SessionDep, current_user: CurrentUserDep
+) -> TotpStatusOut:
+    user = await get_user_by_id(session, current_user.id)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    if not user.totp_enabled:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="2FA is not enabled")
+    if not verify_totp(user.totp_secret, body.code):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid TOTP code")
+    user.totp_secret = ""
+    user.totp_enabled = False
+    await session.commit()
+    return TotpStatusOut(enabled=False)
+
+
+@router.put("/users/{user_id}/totp-reset", response_model=UserOut)
+async def reset_user_totp(
+    user_id: int, session: SessionDep, current_user: CurrentUserDep
+) -> UserOut:
+    _require_admin(current_user)
+    user = await get_user_by_id(session, user_id)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    user.totp_secret = ""
+    user.totp_enabled = False
+    await session.commit()
+    await session.refresh(user)
+    return UserOut.model_validate(user)
+
+
+# ---- API Keys ----
+
+
+@router.get("/api-keys", response_model=list[ApiKeyOut])
+async def list_api_keys(session: SessionDep, current_user: CurrentUserDep) -> list[ApiKeyOut]:
+    keys = await get_api_keys(session, current_user.id)
+    return [ApiKeyOut.model_validate(k) for k in keys]
+
+
+@router.post("/api-keys", response_model=ApiKeyCreated, status_code=status.HTTP_201_CREATED)
+async def create_api_key_endpoint(
+    body: ApiKeyCreate, session: SessionDep, current_user: CurrentUserDep
+) -> ApiKeyCreated:
+    if not body.name.strip():
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="Name is required"
+        )
+    key_obj, plaintext_key = await create_api_key(session, current_user.id, body.name.strip())
+    return ApiKeyCreated(
+        id=key_obj.id,
+        name=key_obj.name,
+        key=plaintext_key,
+        key_prefix=key_obj.key_prefix,
+    )
+
+
+@router.delete("/api-keys/{key_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def revoke_api_key(
+    key_id: int, session: SessionDep, current_user: CurrentUserDep
+) -> None:
+    deleted = await delete_api_key(session, key_id, current_user.id)
+    if not deleted:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="API key not found")
+
+
 @router.get("/audit", response_model=list[AuditOut])
 async def audit_log_endpoint(
     session: SessionDep,