requireAdmin(); I18n::init(); $db = Database::getInstance(); $appTitle = $db->getSetting('app_title', 'UniFi Voucher System'); $error = ''; $success = ''; $newKey = ''; if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_key'])) { if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) { $error = __('error_csrf'); } else { $name = trim($_POST['name'] ?? ''); if ($name === '') { $error = __('error_name_req'); } else { $scope = ($_POST['scope'] ?? 'write') === 'read' ? 'read' : 'write'; $rate = max(0, (int)($_POST['rate_limit'] ?? 0)); $k = ApiKey::generate(); $db->execute( "INSERT INTO api_keys (name, key_prefix, key_hash, scope, rate_limit, created_by) VALUES (?, ?, ?, ?, ?, ?)", [$name, $k['prefix'], $k['hash'], $scope, $rate, $_SESSION['user_id']] ); $auth->writeAuditLog($_SESSION['user_id'], 'api_key_create', 'api_key', null, "API-Key '$name' erstellt"); $newKey = $k['plain']; $success = __('api_created_once'); } } } if (isset($_GET['toggle']) && isset($_GET['token']) && $auth->validateCsrfToken($_GET['token'])) { $row = $db->fetchOne("SELECT is_active FROM api_keys WHERE id = ?", [(int)$_GET['toggle']]); if ($row) { $db->query("UPDATE api_keys SET is_active = ? WHERE id = ?", [$row['is_active'] ? 0 : 1, (int)$_GET['toggle']]); $success = __('api_status_updated'); } } if (isset($_GET['delete']) && isset($_GET['token']) && $auth->validateCsrfToken($_GET['token'])) { $db->query("DELETE FROM api_keys WHERE id = ?", [(int)$_GET['delete']]); $auth->writeAuditLog($_SESSION['user_id'], 'api_key_delete', 'api_key', (int)$_GET['delete'], 'API-Key gelöscht'); $success = __('api_deleted'); } $keys = $db->fetchAll("SELECT k.*, u.name AS creator FROM api_keys k LEFT JOIN users u ON k.created_by = u.id ORDER BY k.created_at DESC"); $csrf = $auth->getCsrfToken(); $currentPage = 'api_keys'; $adminBase = ''; ?> <?= __('api_title') ?> – <?= htmlspecialchars($appTitle) ?>

uvt_…

Authorization: Bearer <key> oder X-API-Key: <key>.

# Voucher erstellen
curl -X POST https://IHRE-DOMAIN/api/vouchers.php \
  -H "Authorization: Bearer uvt_…" \
  -H "Content-Type: application/json" \
  -d '{"site_id":1,"name":"API Gast","max_uses":1,"expire_minutes":480}'

# Sites auflisten
curl https://IHRE-DOMAIN/api/sites.php -H "X-API-Key: uvt_…"

/api/openapi.php