feat(apikeys): create keys with the signed-in session

[LorrisSaintGenez]

What

algolia apikeys create no longer requires an admin API key: being signed in with an application selected is enough.

• Route creation through the dashboard Public API when no API key is passed explicitly, using the OAuth session — same pattern as apikeys rotate.
• Keep the Search API path when --api-key, --admin-api-key or ALGOLIA_API_KEY is set, so --validity and existing scripts keep working.
• Drop the acls: admin annotation, which made the command unreachable for a signed-in user: the CLI-managed key carries WriteACL, without admin.
• Surface actionable errors instead of a raw 403/404: missing --acl, --validity on the session path, unknown application, non-admin explicit key, no session.

Minor breaking change: --acl is now required on both paths. algolia apikeys create with no ACL previously went through on the admin-key path and produced a key that grants nothing; the Public API rejects it outright since acl is a required param. Validating it in the CLI means the error arrives before the call rather than as a raw server response, and the validation no longer depends on whether state.toml holds a key UUID.

The Public API accepts acl, description, indexes and referers, and requires a non-empty description — hence the Created with the Algolia CLI default. It has no validity field, so expiring keys still need an admin key.

apikeys list is unchanged: the Public API has no collection endpoint yet. apikeys get <key> already worked without an admin key.

Test

Sign in first, with an application selected:

algolia auth login
algolia application select

Create a key with several ACLs and restrictions:

algolia apikeys create --acl search,browse -i MOVIES,SERIES -r "https://example.com" -o json

Expect a JSON payload with uuid, value, acl: ["search","browse"], indexes and referers.

Default description:

algolia apikeys create --acl search -o json

Expect "description": "Created with the Algolia CLI".

Error paths:

algolia apikeys create
algolia apikeys create --acl search -u 1h
algolia apikeys create --application-id devDOESNOTEXIST --acl search
algolia apikeys create --acl search --api-key <non-admin-key>

Expect, in order: --acl is required, --validity requires an admin API key, application devDOESNOTEXIST doesn't exist, or your account doesn't have access to it, and a 403 followed by This API key isn't an admin key.

Admin key path still honours --validity:

algolia apikeys create --acl search -u 1h --api-key <admin-key>

Follow-up

Unit tests for this change are intentionally not in this PR — they land in a separate follow-up. Production code shipping uncovered here: the key alias that makes -o jsonpath '{.key}' resolve on the session path, resolving the printer before the API call, --acl enforcement on the Search API path, and the auth.Remediation guidance on credential errors.

GROUT-438

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 4 complexity · 36 duplication

Metric	Results
Complexity	4
Duplication	36

View in Codacy

_{TIP This summary will be updated as you push new changes.}