ApiKeyPermission

Junction table that links API keys to specific permissions, implementing fine-grained access control for programmatic access. While API key scopes define broad categories of access (like 'users:read'), permissions represent specific, granular rights within the system (like 'can_view_user_emails' or 'can_export_data'). This many-to-many relationship allows flexible permission assignment where the same permission can be granted to multiple API keys, and each key can have multiple permissions. This entity tracks not just what permissions are granted, but also who granted them, when they become effective, and when they expire. Temporary permissions are useful for time-limited access, like giving a contractor's API key elevated permissions only during their project. The system evaluates these permissions on every API request, combining them with scopes to determine if an action is allowed. This dual-layer approach (scopes + permissions) provides both simplicity for common cases and flexibility for complex authorization requirements. It's particularly useful when different API keys need slightly different access to the same resources.