Can not create API key for account from admin account

Issues
1

Issue Description

I am creating a API only account which will be used by a management interface to add domains and fetch the required DNS records from stalwart. But when creating the account with only a API key for authenticaiton, I get the error “Secondary credentials cannot be set directly.”

928×877 24.8 KB

Expected Behavior

An account to be created with only an API key and to be able to get that API key for use.

Actual Behavior

I get the error “Secondary credentials cannot be set directly.”

Reproduction Steps

  1. Go to account creation on the admin panel
  2. Start fill in required fields.
  3. Add an authentication item
  4. Select API key
  5. set the name for the key
  6. Click save
  7. Observer error.

Stalwart Version

v0.16.x

Installation Method

Binary (Windows)

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

API keys (and app passwords) are treated as secondary credentials, and those can’t be set directly in the account create/update form, which is where that error comes from. They’re server-generated so the secret is shown once and can’t be injected as an arbitrary value, so adding one as an authentication item while creating the account will always fail.

The way to do this: create the account first (with a primary credential), then generate the API key from the API keys / app-passwords section for that account and copy it for your management integration. The account can then be driven by that key. The form offering “add API key” as an auth item during creation is misleading given it can’t succeed there, so I’ll note that as a UI thing to clean up, but the create-then-generate flow is the intended path.