PR Custody

feat: explicit generate/revoke flow for playground API key

@Malayvasachecks n/achecks…claude/flamboyant-gould-000c1c → main20 files · +653 −78review: @sarahsimionescuupdated 1mo ago

GitHub

▸Description · 2 noise

Summary

Mirrors the settings API-keys UX across the playground config sidebar and getting-started page:

No key → Generate API Key button
Generation → dialog showing the full key exactly once, with Copy + "I Copied It" (disabled until copied, Esc / outside-click blocked)
Key exists → ****-abcd + red Trash icon
Revoke → AlertDialog confirmation → immediate return to Generate state

Why

Previously the "Composio-Playground" key was auto-created on first page load, shipped to the client on every `getApiKey` query, and masked client-side. Two problems:

The full key lived in the React Query cache forever.
Revoking was effectively a no-op — the chat API (`/api/playground`) silently recreated the key on the next message via `getOrCreatePlaygroundApiKey`.

This PR makes generation explicit and revocation actually stick.

Changes

Backend

New `playground.getApiKeyInfo` query — returns `{ id, last4 } | null`. The full key is never sent to the client from a query.
New `playground.createApiKey` mutation — 409s if a playground key already exists (forces revoke-first).
New `playground.revokeApiKey` mutation.
Removed legacy `playground.getApiKey` procedure.
`getOrCreatePlaygroundApiKey` → `getPlaygroundApiKey` (no auto-create). `/api/playground` now returns `400 PLAYGROUND_API_KEY_MISSING` when the user hasn't generated a key.

Frontend

Shared `` at `src/components/core/playground-api-key-manager/` — used by both the playground config sidebar and getting-started page, with per-surface analytics events injected via props.
After revoke, the client optimistically `setData(undefined, { apiKey: null })` so the UI flips to Generate instantly (no race with the invalidate/refetch).
`CopyAsMarkdownButton` no longer bakes in the API key — the markdown output always emits `COMPOSIO_API_KEY=`.
New analytics events: `_API_KEY_GENERATE_CLICKED`, `API_KEY_CREATED`, `_API_KEY_COPIED`, `API_KEY_DIALOG{OPENED,CLOSED}`, `API_KEY_REVOKE{CLICKED,CONFIRMED}`, `API_KEY_REVOKED` across both `DASHBOARD_PLAYGROUND*` and `DASHBOARD_OVERVIEW*` namespaces.

Misc

Added `.claude/launch.json` (local dev-server config).

Test plan

Playground → fresh project: Config sidebar shows "Generate API Key". Click → dialog shows full key, Copy button, "I Copied It" is disabled until copy happens. Esc and outside-click are blocked while locked.
After close: sidebar shows `****-abcd` and a red trash button.
Click trash → confirmation AlertDialog → Revoke → sidebar instantly returns to "Generate API Key".
Before generating, send a chat message → responds with a 400 `PLAYGROUND_API_KEY_MISSING` error, does not silently create a key.
After revoke, send a chat message → same 400 (does not recreate).
Getting Started → Set environment variables section: same Generate / `****-abcd` / revoke behaviour.
Copy as Markdown always emits `COMPOSIO_API_KEY=` regardless of key state.
Analytics events fire for generate, copy, created, dialog open/close, revoke click/confirmed/revoked on both surfaces.

🤖 Generated with Claude Code

▸ 2 bot/status comments hidden

@vercel[bot]1mo ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview, Comment	Apr 17, 2026 1:15am

@polarityinc[bot]1mo ago

E2E Browser Agent Test — Run Report

FAIL — Failed in 40s | PR Created | ComposioHQ/composio_dashboard

Prompt

PR Browser Testing

Triage

Scan the PR diff. If it contains only non-renderable changes (docs, CI configs, README, scripts, type-only refactors, backend-only logic with no UI surface), return successfully with a one-line explanation. Otherwise, proceed.

Phase 1: Analyze

Read the PR description and every changed file

Identify every user-facing route, component, and interaction affected — including indirect effects (e.g., a shared component change ripples to multiple pages...

View in Dashboard

Error

Insufficient credits

loading diff…