From d0c92d84ef17fbd6257e90a6bd94bca63b909ea2 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Wed, 18 Mar 2026 16:33:19 -0600 Subject: [PATCH] fix: update API key deletion authorization check - Changed the authorization check for deleting an API key to use referenceId instead of userId, ensuring proper validation against the current user's ID. --- apps/dokploy/server/api/routers/user.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/dokploy/server/api/routers/user.ts b/apps/dokploy/server/api/routers/user.ts index 56b37b7af..feafa8b58 100644 --- a/apps/dokploy/server/api/routers/user.ts +++ b/apps/dokploy/server/api/routers/user.ts @@ -465,7 +465,7 @@ export const userRouter = createTRPCRouter({ }); } - if (apiKeyToDelete.userId !== ctx.user.id) { + if (apiKeyToDelete.referenceId !== ctx.user.id) { throw new TRPCError({ code: "UNAUTHORIZED", message: "You are not authorized to delete this API key",