Document named local API keys

docs/v2.0/api.md

@@ -64,9 +64,11 @@ sudo systemctl status lqos_api
 Most endpoints require:
 
 - Header: `x-bearer`
-- Value: either the local API bearer token configured under **License & Services**, or your Insight/API-only license key
+- Value: a named local API key from **License & Services**, the legacy local bearer token, or your Insight/API-only license key
 
-The local bearer token authenticates the caller. It does not bypass the mapped-circuit licensing limit. Generate a 256-bit token in **License & Services**, copy it into your API client before saving, and treat it like a password. Saved tokens are not displayed again; generate a replacement if the original is lost.
+Local API keys authenticate callers; they do not bypass the mapped-circuit licensing limit. Administrators can create up to 16 named keys in **License & Services**. LibreQoS displays each generated key once, stores only its SHA-256 digest and non-secret metadata in `/etc/lqos.conf`, and cannot recover it later. Copy the complete `lqos_api_...` value into the client immediately and treat it like a password.
+
+Named keys do not expire automatically. Revoke keys that are no longer needed; creation and revocation may take up to 30 seconds to reach `lqos_api`. Existing license keys and the older single `local_api.bearer_token` remain compatible. The UI labels the older value as **Legacy local API key** and lets an administrator remove it after clients have moved to named keys.
 
 ## What ISPs Can Do with the API
 

docs/v2.0/insight.md

@@ -125,7 +125,7 @@ Without a valid Insight or Local license/grant state, LibreQoS admits only the f
 
 A valid entitled license/grant state enables mapped-circuit counts above the default 1000 limit.
 
-Starting with LibreQoS 2.2, the Node API uses this same unique valid mapped-circuit count. API access is available without an Insight subscription at 1,000 or fewer mapped circuits. Above 1,000, the API requires a valid live entitlement or locally cached signed grant. API clients must still authenticate with either a local API bearer token or an Insight/API-only license key.
+Starting with LibreQoS 2.2, the Node API uses this same unique valid mapped-circuit count. API access is available without an Insight subscription at 1,000 or fewer mapped circuits. Above 1,000, the API requires a valid live entitlement or locally cached signed grant. API clients must still authenticate with a named local API key, the legacy local bearer token, or an Insight/API-only license key. Administrators create and revoke named keys in **License & Services**; changes reach `lqos_api` within 30 seconds.
 
 The default 1000-limit behavior applies when license/grant state is:
 - missing

docs/v2.0/troubleshooting.md

@@ -350,7 +350,7 @@ Recommended checks:
 2. Review `lqosd` logs for requested/allowed/dropped counts.
 3. Reduce mapped circuit count (short term) or update licensing/limits (long term).
 
-The Node API follows the same count starting with LibreQoS 2.2. At 1,000 or fewer mapped circuits, confirm that a local API bearer token is configured and that `lqos_api` is running. Above 1,000, also confirm that the effective API or Insight entitlement is valid.
+The Node API follows the same count starting with LibreQoS 2.2. At 1,000 or fewer mapped circuits, confirm that a named local API key (or compatible legacy/license key) is configured and that `lqos_api` is running. New and revoked named keys may take up to 30 seconds to take effect. Above 1,000, also confirm that the effective API or Insight entitlement is valid.
 
 ### Urgent issue codes and first actions
 

docs/v2.0/update.md

@@ -9,7 +9,7 @@ If you use the XDP bridge, traffic will briefly stop passing through the bridge
 ```{important}
 Starting in v2.0, mapped-circuit ingest depends on valid entitled license/grant state. Without a valid Insight or Local license/grant state, LibreQoS reads only the first 1000 valid mapped circuits into active shaping state. This includes expired or otherwise invalid local grant/license state. See [Insight Licensing Behavior](insight.md#mapped-circuit-limits-and-license-state) and [Troubleshooting](troubleshooting.md).
 
-Starting in v2.2, the Node API uses the same mapped-circuit policy. Networks with 1,000 or fewer valid mapped circuits may use the API without an Insight subscription; larger networks require a valid API or Insight entitlement. API calls remain authenticated with a local API bearer token or an existing license key.
+Starting in v2.2, the Node API uses the same mapped-circuit policy. Networks with 1,000 or fewer valid mapped circuits may use the API without an Insight subscription; larger networks require a valid API or Insight entitlement. API calls remain authenticated. Administrators can create up to 16 named local API keys in **License & Services**; keys are shown once, stored only as SHA-256 digests, and can be revoked. Existing license keys and the legacy local bearer token remain compatible, and key changes may take up to 30 seconds to take effect.
 ```
 
 Run: