We need the ability for Coperniq administrators to restrict which users are allowed to create API keys.

Currently, any Coperniq user can generate an API key, and the key inherits that user's existing permissions. While the permission scope of the API key is appropriate, allowing any user to generate persistent API credentials creates an additional security risk.

Requested functionality

Add a permission or role setting that controls access to API key creation.

Ideally, administrators should be able to:

Restrict API key creation to specific roles, such as Administrators.

Prevent standard users from generating API keys.

Continue allowing those users to access Coperniq normally according to their existing permissions.

Allow administrators to manage who can create API keys without having to remove the user's normal project access.

Ideally provide visibility into which users have generated API keys.

Example

A Sales user may have access to a limited set of projects in Coperniq. They should be able to access those projects normally, but they should not automatically have the ability to generate an API key that provides persistent programmatic access to those same projects.

An administrator or designated integration user should be able to generate API credentials when required.

Security consideration

API keys are persistent credentials and can be used outside of the Coperniq UI. Even though the key inherits the creating user's permissions, allowing every user to generate API credentials increases the potential for unauthorized access or accidental exposure of Coperniq data.

We would like API key creation to be treated as a privileged capability that can be restricted by an administrator.