Janus
Janus explores an admin panel and a backend service that keep API keys out of client applications. The project is ongoing: the target architecture is settled, but not every feature is finished.
- Status
- In development
- Type
- Personal project
- Role
- Product design, permission modeling, and development of both the backend service and the panel.
The initial problem
API keys tend to be scattered across projects, rotated poorly, and exposed directly to the applications that use them.
Context
More integrations means more secrets, more permissions, and more rotations. Traceability quickly falls short.
Objectives
- Centralize secrets
- Reduce their exposure
- Control which applications are authorized
- Make revocation and auditing practical
The solution
A proxy service grants access based on the calling application's identity and permissions, while a dedicated panel handles lifecycle and logs.
Features
- Centralized storage
- Access proxy
- Authorized applications
- Permissions
- Journaling
- Revocation
Architecture
A Spring Boot service exposing a REST API, PostgreSQL persistence, and separate Docker Compose environments.
Technologies
Java · Spring Boot · Spring Security · REST API · PostgreSQL · Docker
Key decisions
- Never pass the secret along when it is not needed
- Trace accesses without tracing secrets
- Design for revocation from the first model
Challenges
- Permission model
- Separating administration from consumption
- Rotation without downtime
Learnings
- Secret management is a lifecycle problem
- Logs have to stay useful without becoming sensitive
Current state
The project is currently: in development. This reflects the state set in the administration area.
Next steps
- Finish the proxy flow
- Strengthen authorization tests
- Document the production setup
Media