fix: harden public api token storage

2026-05-23 17:47:13 +02:00
parent ee663afffb
commit e2b95f183d
6 changed files with 23 additions and 11 deletions
@@ -124,7 +124,7 @@ and are never stored.
 |--------|------|-------------|
 | id | INTEGER | Primary key |
 | name | VARCHAR(120) | Name/description of the token |
-| key_hash | VARCHAR(64) | SHA-256 hash of the token secret |
+| key_hash | VARCHAR(255) | Bcrypt hash of the token secret |
 | key_prefix | VARCHAR(16) | Non-secret prefix for operator identification |
 | scopes | TEXT | Comma-separated scopes such as `reports:read` |
 | active | BOOLEAN | Whether the token can be used |