Time-bound Access keys

[dacrymn]

Describe the feature or potential improvement

Add first-class support for expiring SDK/API keys to reduce long-lived credential risk and enforce rotation.

Purpose:
Prevent orphaned, permanent credentials
Support access governance, leaks, offboarding

Feature
Keys must have an expiresAt (or enforce max TTL via org policy)
Fail authentication after expiry

Admin controls:
list keys with expiry, last-used, created-by, scope
change key expiry

UI/API
UI: key creation requires selecting TTL (or inherits org default)
API: create key with TTL/expiresAt; revoke; list/filter by expiring soon

Willingness to Contribute:
Yes

Additional information

No response

[maxdeichmann]

Thanks a lot for the discussion. We will consider this as we revamp the our API key implementation.