keys

Per-user API key resolution with encryption at rest.

Users can configure their own API keys via the account settings panel. Keys are encrypted with Fernet before storing in the database. Only admin accounts fall back to global system keys.

clear_user_keys(user_id) async

Remove all of a user's personal API keys (revert to system keys).

Parameters:

Name	Type	Description	Default
user_id	str	The user's UUID.	required

get_user_key_status(user_id) async

Report each provider's key source without exposing values.

Returns 'personal' (user-configured, encrypted at rest), 'system' (fallback from config), or 'none' per provider.

Parameters:

Name	Type	Description	Default
user_id	str	The user's UUID.	required

Returns:

Type	Description
dict[str, str]	Dict with 'deepseek', 'tavily', 'scrapingant' status strings.

resolve_user_keys(user_id) async

Resolve effective API keys for a user.

Personal (Fernet-encrypted) keys win over the system keys; missing personal keys fall back to the system-level values from config.

Parameters:

Name	Type	Description	Default
user_id	str	The user's UUID.	required

Returns:

Type	Description
dict[str, str | None]	Dict with 'deepseek', 'tavily', 'scrapingant' entries — each a
dict[str, str | None]	key string or None when nothing is configured.

save_user_keys(user_id, keys) async

Encrypt and persist a user's personal API keys (partial update).

Only keys in the allowed set are stored; empty values are ignored so clearing a single key is done via :func:clear_user_keys.

Parameters:

Name	Type	Description	Default
user_id	str	The user's UUID.	required
keys	dict[str, str]	Dict mapping provider names ('deepseek', 'tavily', 'scrapingant') to raw key strings.	required