Community plugin adds per-key allowlists for Jellyfin API keys
In Jellyfin, any API key you create carries the same weight as an admin key. A community developer found that uncomfortable enough to build a fix, and has now published it as an early release: API Key Middleware, with an open request for feedback.
How the scoping works
Each key gets its own allowlist built from an HTTP method paired with a path. The rollout is intentionally gentle:
- A freshly created key begins in audit mode, so requests pass through untouched.
- After a few days of normal use, you visit the rule builder on the plugin page. Calls the key actually made are pre-selected.
- You check that selection, move the key to enforce, and any request outside the list receives a 403.
The plugin surfaces every endpoint the server exposes, each with Jellyfin's own description. Admin-only endpoints are marked, as are the ones a given key has been observed hitting. The scope is limited to API keys: user sessions and anonymous traffic are untouched.
Who it affects
Anyone who issues keys to dashboards, monitoring agents or automation scripts. The author originally wrote it for a single server, motivated by the risk that one exposed configuration file would hand over everything, and then tidied it up for a wider audience.
Caveats worth knowing
- Development and testing happened on Jellyfin 12.4.0.
- It fails open: disabling the plugin or a load failure, such as after a Jellyfin upgrade, restores full access to every key. Confirm it reports as Active after updating.
- It narrows what keys can do; it does not replace Jellyfin updates, a firewall or a VPN.
- The author states openly that the work was done together with Claude (Anthropic's AI) through Claude Code, which handled a large share of the implementation, testing and security review, while the author set direction, made decisions and validated everything on their own server.
The code is GPL-3.0. Feedback is wanted on bypasses (authentication methods, route edge cases), usability and behavior on other setups; security reports should go through GitHub's private channel.
Commentary for self-hosters
Scoped API keys are a gap many of us have tolerated for years, so this is a step in the right direction. Treat it as one hardening layer rather than a perimeter: since it fails open, a silent load failure after an upgrade quietly returns full access, so add an "is the plugin Active?" check to your post-update routine. Run in audit mode first, let real traffic accumulate, then enforce and watch logs for unexpected 403s. If you run several plugins that talk to the Jellyfin API, our Jellyfin plugins page shows how we handle compatibility.