Allow server admins to restrict API key and access token management by role

Allow server admins to restrict API key and access token management by role

Problem

On hosted or multi-tenant BTCPay Server instances, store owners can currently access credential-management surfaces that may be broader than an operator wants to allow for merchant accounts.

The main surfaces are:

• /account/apikeys for account Greenfield API keys
• Greenfield API key authorization and creation flows
• Store Settings -> Access Tokens at /stores/{storeId}/tokens
• Bitpay-compatible store access token creation, display, and revocation
• Legacy store API key generation, regeneration, and revocation

For operators hosting stores for merchants, this creates a security and operational concern. Store owners may need to manage invoices, checkout settings, rates, webhooks, or payouts, but the server operator may not want those users to create long-lived API credentials or store access tokens.

Requested Behavior

Add a server-admin-controlled policy setting to restrict API key and access token management by role.

Ideally, server admins could configure which roles are allowed to:

• View /account/apikeys
• Create Greenfield API keys
• Authorize API keys through the UI flow
• Use Greenfield API endpoints that create user API keys
• View the store Access Tokens page
• Create Bitpay-compatible store access tokens
• View or revoke Bitpay-compatible store access tokens
• Generate, regenerate, or revoke legacy store API keys
• Use the /api-tokens and /api-access-request pairing flows

Users without an allowed role should receive a clear 403 or equivalent UI message.

UI Considerations

The store Access Tokens page currently includes controls for multiple credential types, including a link to account Greenfield API keys, Bitpay-compatible access tokens, and legacy API keys.

If the current user is not allowed to manage API keys or access tokens, the Access Tokens page should either be hidden from navigation or show a locked-down message explaining that credential management is disabled by the server administrator.

The account API Keys page should behave similarly.

Why This Matters

This is useful for hosted BTCPay deployments where server admins want tighter control over credential creation. Store owners may still need broad store-management permissions, but API keys and access tokens can increase blast radius if leaked, shared with third-party systems, or used outside the intended integration model.

It would also give operators a cleaner built-in control instead of having to maintain a deployment-specific plugin, reverse-proxy rule, or fork.

Possible Implementation Direction

This could be implemented as a server policy setting, similar to existing role-based permission controls, where server admins can allow API key and access token management for:

• Server admins only
• Selected server/store roles
• Everyone with current default behavior

The default should preserve existing behavior for backward compatibility.

Scope

This request is about controlling credential-management experiences, not removing the existing APIs or token types.

The main goal is to let server admins decide which roles can create or manage API keys and access tokens across both Greenfield and Bitpay-compatible flows.