API features - Security

Feature Request
1

Hi Matt,

I’m building a custom Node.js frontend that connects (via SOAP API) to multiple ApisCP backends to provide a unified management interface for our hosting clients. Recent events (specifically the React2Shell vulnerability CVE-2025-55182) highlighted a critical architectural concern:

The Problem: If our frontend server is compromised, an attacker gains access to API keys that have full administrative access to all connected ApisCP backends. This creates a single point of catastrophic failure .

Feature Requests:

  1. Scoped API Keys - Is there any plan or vote for this?
  2. Time-Limited Tokens - API keys that expire after X hours/days, forcing rotation
  3. Operation Whitelisting - Specify exactly which API methods a key can call ?

I am also looking into architecture design change of my application. Building an API gateway/proxy that intercepts and filters requests, but would like to hear if there are better options available.

2

Thank you for your interest in ApisCP. This feature may be requested via feedback.apiscp.com.