Feature Request: Manual deletion and automatic cleanup of revoked App Keys #320

Problem / motivation

Currently, revoked App Keys remain permanently stored and visible in the App Key management interface.

While revocation prevents further authentication, there is no way to permanently remove obsolete App Keys. Over time, this can lead to an accumulation of unused entries and make App Key management unnecessarily cluttered.

A way to manually delete revoked keys or automatically clean them up after a configurable retention period would improve usability and keep the database tidy.

Proposed solution

I propose two complementary features:

1. Manual deletion

• Add a Delete action for revoked App Keys in the management interface.
• Require confirmation before permanently deleting a key.
• Only allow deletion of already revoked keys.

2. Automatic cleanup

• Introduce an optional configuration setting to automatically delete revoked App Keys after a configurable number of days.
• The cleanup should periodically remove keys that have been revoked for at least the configured retention period.

For example:

• 0 = Disabled (default)
• 7 = Delete after 7 days
• 30 = Delete after 30 days
• 90 = Delete after 90 days

Automatic cleanup should be disabled by default to preserve the current behaviour.

Manual deletion and automatic cleanup should work independently of each other.

Revocation should remain the immediate security mechanism, while deletion should be treated as a separate housekeeping operation.

Alternatives considered

Currently, revoked App Keys can simply be left in the database indefinitely.

Manually removing database entries would be possible in theory, but it requires direct database access and relies on internal implementation details. This is not a convenient or maintainable solution for regular administration.

Area

Other

Additional context

No response