-- Server-to-server API access (see admin/api_access.php and
-- public/api/claim_link_lookup.php) -- a bearer token an external tool
-- (e.g. Sendy, for the claim-link-by-email lookup requested via Canny)
-- sends in an Authorization header instead of a session cookie. Only the
-- hash is ever stored, same as admin_password_resets.token_hash -- the
-- raw token is shown once, at creation time, and never recoverable again.

CREATE TABLE IF NOT EXISTS api_tokens (
    id           INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    label        VARCHAR(190) NOT NULL,
    token_hash   CHAR(64) NOT NULL UNIQUE,
    created_by   INT UNSIGNED NULL,
    created_at   DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    last_used_at DATETIME NULL,
    revoked_at   DATETIME NULL,
    CONSTRAINT fk_api_token_admin FOREIGN KEY (created_by) REFERENCES admin_users(id) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
