AkpakaProsper · Sep 29, 2026
@@ -18,3 +18,6 @@ coverage/
 
 !.env.example
 .aider*
+branch_structure.json
+temp_auto_push.bat
+temp_interactive_push.bat
diff --git a/migrations/0024_hash_api_keys.down.sql b/migrations/0024_hash_api_keys.down.sql
@@ -0,0 +1 @@
+-- Cannot accurately revert since plaintext keys were deleted
diff --git a/migrations/0024_hash_api_keys.sql b/migrations/0024_hash_api_keys.sql
@@ -0,0 +1,2 @@
+-- Migration: nulls existing api_key values to prevent plaintext credential exposure
+UPDATE usage_events SET api_key = NULL WHERE api_key IS NOT NULL;
diff --git a/src/routes/proxyRoutes.ts b/src/routes/proxyRoutes.ts
@@ -160,7 +160,7 @@ export function createProxyRouter(deps: ProxyDeps): Router {
 
       // 3. Per-API-key rate-limit check (tier-aware; complements the per-user
       //    token-bucket check already applied by gatewayRateLimitMiddleware).
-      const rateResult = await rateLimiter.check(apiKeyHeader, res.locals.apiKeyTier as string | undefined);
+      const rateResult = await rateLimiter.check(keyRecord.id, res.locals.apiKeyTier as string | undefined);
       if (!rateResult.allowed) {
         const retryAfterSec = Math.ceil((rateResult.retryAfterMs ?? 1000) / 1000);
         res.set('Retry-After', String(retryAfterSec));
@@ -341,7 +341,7 @@ export function createProxyRouter(deps: ProxyDeps): Router {
                 const recorded = await usageStore.record({
                   id: randomUUID(), // ID of the usage event itself
                   requestId,        // Idempotency key — prevents double-counts
-                  apiKey: apiKeyHeader,
+                  // apiKey field omitted to prevent storing plaintext keys
                   apiKeyId: keyRecord.id,
                   apiId: String(apiEntry.id),
                   endpointId: endpoint.endpointId,
@@ -355,7 +355,7 @@ export function createProxyRouter(deps: ProxyDeps): Router {
                   defaultUsageSseBroadcaster.emitForUser(keyRecord.userId, {
                     id: randomUUID(),
                     requestId,
-                    apiKey: apiKeyHeader,
+                    // apiKey field omitted to prevent broadcasting plaintext keys
                     apiKeyId: keyRecord.id,
                     apiId: String(apiEntry.id),
                     endpointId: endpoint.endpointId,

diff --git a/src/services/usageStore.ts b/src/services/usageStore.ts
@@ -239,17 +239,16 @@ export class PostgresUsageStore implements UsageAdminStore {
             api_id,
             endpoint_id,
             api_key_id,
-            api_key,
             developer_id,
             amount_usdc,
             request_id,
             status_code,
             created_at
           )
-          VALUES ($1, $2, $3, $4, $5, (
+          VALUES ($1, $2, $3, $4, (
             SELECT COALESCE(a.developer_id::text, '')
             FROM apis a WHERE a.id = $2 LIMIT 1
-          ), $6, $7, $8, $9)
+          ), $5, $6, $7, $8)
           ON CONFLICT (request_id, developer_id) DO NOTHING
           RETURNING id
         `,
@@ -258,7 +257,6 @@ export class PostgresUsageStore implements UsageAdminStore {
           event.apiId,
           event.endpointId,
           event.apiKeyId,
-          event.apiKey,
           event.amountUsdc,
           event.requestId,
           event.statusCode,

diff --git a/src/types/gateway.ts b/src/types/gateway.ts
@@ -14,7 +14,7 @@ export interface ApiKey {
 export interface UsageEvent {
   id: string;
   requestId: string;
-  apiKey: string;
+  apiKey?: string;
   apiKeyId: string;
   apiId: string;
   endpointId: string;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		-- Cannot accurately revert since plaintext keys were deleted
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		-- Migration: nulls existing api_key values to prevent plaintext credential exposure
		UPDATE usage_events SET api_key = NULL WHERE api_key IS NOT NULL;