maikschneider / api-key

dev-main 2026-10-21 12:47 UTC

Requires

• php: ^8.2
• typo3/cms-core: ^13.4 || ^14.3
• typo3/cms-frontend: ^13.4 || ^14.3

Requires (Dev)

• armin/editorconfig-cli: ^2.1
• ergebnis/composer-normalize: ^2.45
• friendsofphp/php-cs-fixer: ^3.12
• move-elevator/composer-translation-validator: ^1.3
• phpstan/extension-installer: ^1.3
• saschaegerer/phpstan-typo3: ^3.0
• symfony/translation: ^7.2
• typo3/cms-install: ^13.4 || ^14.3
• typo3/testing-framework: ^9.5

GPL-2.0-or-later

• Maik Schneider

• api
• Authentication
• typo3
• psr-15
• typo3-cms-extension
• api-key

Published on Packagist.org on 2026-10-21 12:47 UTC

README

TYPO3 extension api_key

Stateless API key authentication for TYPO3. Scripts, cron jobs, CI pipelines and server-to-server integrations send a key, and any API, PSR-15 middleware or auth service can verify it, without creating sessions or cookies.

curl -H 'X-API-Key: t3key_…' https://example.com/api/articles
curl -H 'Authorization: Bearer t3key_…' https://example.com/api/articles

Warning

This extension is under development and not released yet.

✨ Features

• X-API-Key and Authorization: Bearer headers. Bearer tokens without the t3key_ prefix are left to other authenticators
• Service keys, keys bound to a frontend user and keys bound to a backend user
• Keys are stored as HMAC hashes and shown only once at creation
• Optional restrictions per key: scopes, expiry, IP ranges, sites
• No fe_sessions rows, no Set-Cookie, no lastlogin updates

🔥 Installation

composer require maikschneider/api-key

🔑 Managing keys

vendor/bin/typo3 apikey:create --title="CI deploy" --scope=articles:write --expires="+90 days"
vendor/bin/typo3 apikey:list
vendor/bin/typo3 apikey:revoke t3key_KhhNfTRL

The key is printed once and cannot be recovered.

📙 Documentation

Usage, configuration, the developer guide for consumers and security notes: docs.typo3.org.

Tip

Behind Apache, bearer tokens only reach TYPO3 with CGIPassAuth On. The X-API-Key header always works.

🧑‍💻 Contributing

See CONTRIBUTING.md.

⭐ License

This project is licensed under GNU General Public License 2.0 (or later).