Repository navigation
chore(api-keys): remove the api-key-read-only flag - #9879
Merged
Merged
Conversation
… keys are live Every production pod runs v0.9.53, which enforces key access, and the flag is on in prod AppConfig. Read-only key creation is now always available: the create modal always offers Access (except where a key must be full access), and the create use case no longer consults the flag.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
 [Medium impact] The PR appears safe to merge; no actionable issues were found. SummaryRemoves the rollout flag so read-only API keys are always available.
Known limitation acknowledged by waleedlatif1: rolling back below v0.9.53 requires revoking read-only keys first, because older releases treat them as full access. Reviews (1) · Last reviewed commit: "chore(api-keys): remove the api-key-read..." · Reviewed by Greptile |
waleedlatif1
added a commit
that referenced
this pull request
Nov 11, 2026
Removes the api-key-read-only flag from the Platform surface too: the surface contract, organization surface resolver, the read-only key hook, and both create-key modals now always offer read-only access.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Read-only API keys (#9855) are live: every production app pod runs v0.9.53, which enforces key access, and
api-key-read-onlyis on in production AppConfig (feature-flags v45). This removes the flag so read-only key creation is always available.API_KEY_READ_ONLYfallback env, andlib/api-key/feature-flag.tsresolveIssueSettingsis now synchronous)WorkspaceFeatureFlagsEnforcement of read-only keys never depended on the flag, so this changes nothing for existing keys.
Rollout
After this ships to production, remove
api-key-read-onlyfrom the prodfeature-flagsAppConfig document. Self-hosted deployments get read-only keys on upgrade. Rolling back below v0.9.53 still requires revoking read-only keys first, since older code serves them as full access.