What problem does it solve? Scripts, cron jobs, and third-party integrations need to call a NocoBase App's API as a real user without interactive sign-in, and teams need to diagnose why issued keys are rejected. This Skill registers the API Keys plugin so callers authenticate with an x-api-key header that resolves to the key owner's session and roles. ## Core Features & Use Cases - Plugin registration: Wires the server and client plugin halves, the Better Auth apiKey plugin, the apikey table migration, and the Settings page for key management. - Key-based API access: Callers send an x-api-key header and auth.required() resolves the key into the owner's session, so authorization evaluates that user's roles with no route changes. - Troubleshooting rejected keys: Explains Better Auth's 401 KEY_EXPIRED, 401 KEY_NOT_FOUND, and 429 USAGE_EXCEEDED responses, plus the enableSessionForAPIKeys default that must stay on. - Use Case: A cron job needs to sync orders nightly. Register the plugin, grant page:api-keys/access, create a key in the Settings page, and call curl -H 'x-api-key: <key>' against the App's API. ## Quick Start Register the API Keys plugin in my NocoBase App's server and client plugin lists, add apiKey() to the auth config, run the migration, and show me how to call an authenticated route with an x-api-key header.
