The server should support api keys

[bmchrist]

Please require an API key or similar authentication method from an iOS client. Use whatever are the latest standards apple recommends.
Leave information in Claude.MD so the ios client claude agent can use it to implement the client side work.

[bmchrist]

@claude please implement this issue and open a pull request

[claude]

Claude encountered an error —— View job

---

Working on API Key Authentication Implementation

I'll implement API key authentication for the iOS client following Apple's latest standards.

Task List:

• Read existing codebase to understand current structure
• Research Apple's authentication recommendations
• Implement API key authentication middleware
• Add API key generation and storage
• Update endpoints to require authentication
• Update CLAUDE.md with iOS implementation details
• Test the implementation
• Commit and push changes
• Provide PR creation link

Starting work now...

[bmchrist]

@claude try again - start with reviewing the checklist you wrote in your comment

[claude]

Claude finished @bmchrist's task —— View job • claude/issue-2-20250922-1444 • Create PR ➔

---

API Key Authentication Implementation Complete ✅

I've successfully implemented API key authentication for the iOS client following Apple's latest security standards.

Task List:

• Review existing codebase to understand current structure
• Research Apple's authentication recommendations
• Implement API key authentication middleware
• Add API key generation and storage
• Update endpoints to require authentication
• Update CLAUDE.md with iOS implementation details
• Test the implementation
• Commit and push changes
• Provide PR creation link

What was implemented:

1. Secure API Key System:

   • 256-bit cryptographically secure API keys using crypto/rand
   • Header-based authentication with X-API-Key
   • Middleware to protect all endpoints except health check
   • Master key system for controlled API key generation

2. Protected Endpoints:

   • /register - Device registration
   • /check/:user_id - Manual turn checking
   • /diagnostics/:user_id - User diagnostics
   • /users-by-token/:device_token - Find users by device

3. iOS Implementation Guide in CLAUDE.md:

   • Complete Keychain storage implementation with code examples
   • Network request examples with authentication headers
   • Biometric authentication integration (Face ID/Touch ID)
   • Security best practices following Apple's standards
   • Initial setup flow documentation

4. Additional Features:

   • API key persistence in api_keys.json
   • Last used time tracking
   • Comprehensive test coverage
   • Updated README documentation

Security Features:

• Constant-time comparison to prevent timing attacks
• Secure storage recommendations (iOS Keychain)
• HTTPS-only communication requirement
• API key rotation support
• Biometric protection examples

The iOS client can now securely authenticate with the server using API keys stored in the iOS Keychain, following Apple's latest security recommendations.