DecodeAPIKey retrieves API key ID and the secret from the given key generated with GenerateAPIKey.

GenerateAPIKey produces an API key and returns the secret bcrypt hash to be persisted.

ErrCredentialsInvalid should be returned when details of the authentication failure should be hidden (e.g.

ErrPermissionDenied should be returned if the actor does not have sufficient permissions for the action.

AdhocProfile describes a profile that is controlled by AdhocService.

TokenUser represents a user info retrieved from the validated JWT token.