flake: use self.outPath instead of fetchFromGitea with hardcoded rev

The overlay was pinning a specific commit via fetchFromGitea, requiring
manual hash updates every time the fork changed. Now uses self.outPath
which points to the flake's own source — the consuming repo's flake.lock
tracks the rev and hash automatically.

.gitea/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: Build, Lint, and Test
+name: Build and Test
 
 on:
   push:
@@ -12,38 +12,28 @@ on:
 
 jobs:
   build-and-test:
-    name: Build, Lint, and Test
+    name: Build and Test
     runs-on: ubuntu-latest
     if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')"
     env:
       COMPOSE_FILE: ./docker-compose.ci.yml
       MIX_ENV: test
+      DOCKER_BUILDKIT: 1
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Pull prebuilt images
-        run: docker compose pull
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./docker/dev.Dockerfile
-          load: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Run Docker image
-        run: docker compose up --detach
-
-      - name: Install Elixir and JS deps
+      - name: Build and run Docker image
         run: |
-          docker compose exec -T phx mix deps.get && yarn install && cd assets && yarn install && cd ..
+          docker compose build --no-cache
+          docker compose up --detach
+
+      - name: Install deps
+        run: |
+          docker compose exec -T phx mix deps.get
+          docker compose exec -T phx yarn install
+          docker compose exec -T phx sh -c "cd assets && yarn install"
 
       - name: Create and Migrate database
         run: |
@@ -53,5 +43,5 @@ jobs:
       - name: Run code checks
         run: docker compose exec -T phx mix check --no-fix --no-retry
 
-      - name: Run API tests
-        run: docker compose exec -T phx mix test test/pinchflat_web/controllers/api test/pinchflat_web/api_auth_plug_test.exs --trace
+      - name: Run tests
+        run: docker compose exec -T phx mix test --trace

.gitea/workflows/nix-check.yml

@@ -0,0 +1,38 @@
+name: Nix Flake Check
+
+on:
+  push:
+    branches:
+      - master
+      - feature/*
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  flake-check:
+    name: Nix Flake Check
+    runs-on: ubuntu-latest
+    if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Check flake evaluates
+        run: nix flake check --no-build
+
+      - name: Verify source hash
+        run: nix build .#pinchflat.src --no-link --print-out-paths
+
+      - name: Verify mix deps hash
+        run: nix build .#pinchflat.mixFodDeps --no-link --print-out-paths
+
+      - name: Verify yarn cache hash
+        run: nix build .#pinchflat.yarnOfflineCache --no-link --print-out-paths

config/config.exs

@@ -26,7 +26,6 @@ config :pinchflat,
   basic_auth_username: "",
   basic_auth_password: "",
   expose_feed_endpoints: false,
-  api_token: "",
   file_watcher_poll_interval: 1000,
   timezone: "UTC",
   base_route_path: "/"

config/runtime.exs

@@ -23,8 +23,7 @@ end
 
 config :pinchflat,
   basic_auth_username: System.get_env("BASIC_AUTH_USERNAME"),
-  basic_auth_password: System.get_env("BASIC_AUTH_PASSWORD"),
-  api_token: System.get_env("PINCHFLAT_API_TOKEN")
+  basic_auth_password: System.get_env("BASIC_AUTH_PASSWORD")
 
 arch_string = to_string(:erlang.system_info(:system_architecture))
 

config/test.exs

@@ -12,10 +12,6 @@ config :pinchflat,
 
 config :pinchflat, Oban, testing: :manual
 
-# API token is not set in tests by default — allows tests to run without auth.
-# Individual tests that need auth can set it via Application.put_env.
-config :pinchflat, :api_token, nil
-
 # Configure your database
 #
 # The MIX_TEST_PARTITION environment variable can be used

docker-compose.ci.yml

@@ -5,11 +5,6 @@ services:
       dockerfile: ./docker/dev.Dockerfile
     environment:
       - MIX_ENV=test
-    volumes:
-      - '.:/app'
-      # These lines ensure the deps can be saved as build artifacts for caching
-      - '/app/deps'
-      - '/app/_build'
     ports:
       - '4008:4008'
     command: tail -F /dev/null

docs/API.md

@@ -5,22 +5,17 @@ MCP server integration and other automation use cases.
 
 ## API Authentication
 
-The API is protected by a Bearer token. Set the `PINCHFLAT_API_TOKEN`
-environment variable to a secure value:
+The API always requires a Bearer token — there is no open-access mode.
+Generate a token from the web UI under **Settings → API Access**:
 
-```bash
-docker run \
-  -e PINCHFLAT_API_TOKEN=your-secret-token \
-  ...
-```
-
-If the token is not set, API authentication is disabled (useful for
-development, but **not recommended for production**).
+1. Navigate to Settings
+2. Click "Generate API Token"
+3. Copy the token (it won't be shown in full again)
 
 Clients must send the token in the `Authorization` header:
 
 ```
-Authorization: Bearer your-secret-token
+Authorization: Bearer *** to regenerate or revoke the token at any time.
 ```
 
 ## API Endpoints
@@ -29,54 +24,54 @@ All endpoints are under `/api/v1`.
 
 ### Sources
 
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/v1/sources` | List all sources |
-| GET | `/api/v1/sources/:id` | Get a source with its pending tasks |
-| POST | `/api/v1/sources` | Create a new source |
-| PUT | `/api/v1/sources/:id` | Update a source |
-| DELETE | `/api/v1/sources/:id` | Delete a source (marks for deletion) |
-| POST | `/api/v1/sources/:source_id/force_download_pending` | Force download pending media |
-| POST | `/api/v1/sources/:source_id/force_redownload` | Force re-download existing media |
-| POST | `/api/v1/sources/:source_id/force_index` | Force re-index |
-| POST | `/api/v1/sources/:source_id/force_metadata_refresh` | Force metadata refresh |
-| POST | `/api/v1/sources/:source_id/sync_files_on_disk` | Sync files on disk |
+| Method | Path                                                | Description                          |
+| ------ | --------------------------------------------------- | ------------------------------------ |
+| GET    | `/api/v1/sources`                                   | List all sources                     |
+| GET    | `/api/v1/sources/:id`                               | Get a source with its pending tasks  |
+| POST   | `/api/v1/sources`                                   | Create a new source                  |
+| PUT    | `/api/v1/sources/:id`                               | Update a source                      |
+| DELETE | `/api/v1/sources/:id`                               | Delete a source (marks for deletion) |
+| POST   | `/api/v1/sources/:source_id/force_download_pending` | Force download pending media         |
+| POST   | `/api/v1/sources/:source_id/force_redownload`       | Force re-download existing media     |
+| POST   | `/api/v1/sources/:source_id/force_index`            | Force re-index                       |
+| POST   | `/api/v1/sources/:source_id/force_metadata_refresh` | Force metadata refresh               |
+| POST   | `/api/v1/sources/:source_id/sync_files_on_disk`     | Sync files on disk                   |
 
 ### Media Items
 
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/v1/media` | List all media items (optional `?source_id=X` filter) |
-| GET | `/api/v1/media/search?q=query` | Search media items |
-| GET | `/api/v1/media/:id` | Get a media item |
-| PUT | `/api/v1/media/:id` | Update a media item |
-| DELETE | `/api/v1/media/:id` | Delete media files |
-| POST | `/api/v1/media/:media_item_id/force_download` | Force download a media item |
+| Method | Path                                          | Description                                           |
+| ------ | --------------------------------------------- | ----------------------------------------------------- |
+| GET    | `/api/v1/media`                               | List all media items (optional `?source_id=X` filter) |
+| GET    | `/api/v1/media/search?q=query`                | Search media items                                    |
+| GET    | `/api/v1/media/:id`                           | Get a media item                                      |
+| PUT    | `/api/v1/media/:id`                           | Update a media item                                   |
+| DELETE | `/api/v1/media/:id`                           | Delete media files                                    |
+| POST   | `/api/v1/media/:media_item_id/force_download` | Force download a media item                           |
 
 ### Media Profiles
 
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/v1/media_profiles` | List all media profiles |
-| GET | `/api/v1/media_profiles/:id` | Get a media profile |
-| POST | `/api/v1/media_profiles` | Create a media profile |
-| PUT | `/api/v1/media_profiles/:id` | Update a media profile |
-| DELETE | `/api/v1/media_profiles/:id` | Delete a media profile |
+| Method | Path                         | Description             |
+| ------ | ---------------------------- | ----------------------- |
+| GET    | `/api/v1/media_profiles`     | List all media profiles |
+| GET    | `/api/v1/media_profiles/:id` | Get a media profile     |
+| POST   | `/api/v1/media_profiles`     | Create a media profile  |
+| PUT    | `/api/v1/media_profiles/:id` | Update a media profile  |
+| DELETE | `/api/v1/media_profiles/:id` | Delete a media profile  |
 
 ### Settings
 
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/v1/settings` | Get settings (route_token excluded) |
-| PUT | `/api/v1/settings` | Update settings |
-| GET | `/api/v1/app_info` | Get app info (version, environment, etc.) |
+| Method | Path               | Description                               |
+| ------ | ------------------ | ----------------------------------------- |
+| GET    | `/api/v1/settings` | Get settings (route_token excluded)       |
+| PUT    | `/api/v1/settings` | Update settings                           |
+| GET    | `/api/v1/app_info` | Get app info (version, environment, etc.) |
 
 ### Tasks
 
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/v1/tasks` | List all tasks (optional `?source_id=X` filter) |
-| GET | `/api/v1/tasks/:id` | Get a task |
+| Method | Path                | Description                                     |
+| ------ | ------------------- | ----------------------------------------------- |
+| GET    | `/api/v1/tasks`     | List all tasks (optional `?source_id=X` filter) |
+| GET    | `/api/v1/tasks/:id` | Get a task                                      |
 
 ## Response Format
 
@@ -89,7 +84,7 @@ All responses are JSON. Successful responses use:
 Error responses use:
 
 ```json
-{"errors": {"field": "error message"}}
+{ "errors": { "field": "error message" } }
 ```
 
 ## Example: Create a Source
@@ -105,4 +100,4 @@ curl -X POST http://localhost:8945/api/v1/sources \
       "original_url": "https://www.youtube.com/@SomeChannel"
     }
   }'
-```
+```

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1782959384,
+        "narHash": "sha256-xnJJk+ct+D2+wdRxj1wk36w5zV9RVESwRqcklPdt3fM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "65179426c83bb3f6bc14898b42ea1c6f01d374b0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,57 @@
+{
+  description = "Pinchflat fork with JSON REST API for MCP integration";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs =
+    { self, nixpkgs, ... }:
+    let
+      supportedSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+    in
+    {
+      overlays = {
+        default = final: prev: {
+          pinchflat = prev.pinchflat.overrideAttrs (
+            old: {
+              # Use the flake's own source — rev and hash are tracked
+              # by flake.lock in the consuming repo, no manual updates needed
+              src = self.outPath;
+
+              # Deps hashes are identical to upstream — mix.lock and yarn.lock
+              # are unchanged in this fork. If they drift, nix build will
+              # print the correct hash to use.
+              mixFodDeps = old.mixFodDeps.overrideAttrs (_: {
+                hash = "sha256-7zLlOzBJcvookYX/4SNC0O1Yr62LIKH9R8rONl3diSs=";
+              });
+
+              yarnOfflineCache = old.yarnOfflineCache.overrideAttrs (_: {
+                sha256 = "sha256-xJL+qcohtu+OmZ31E1QU9uqBWAFGejKIO3XRd+R6z/4=";
+              });
+            }
+          );
+        };
+      };
+
+      packages = forAllSystems (
+        system:
+        let
+          pkgs = import nixpkgs {
+            inherit system;
+            overlays = [ self.overlays.default ];
+          };
+        in
+        {
+          default = pkgs.pinchflat;
+          pinchflat = pkgs.pinchflat;
+        }
+      );
+    };
+}

lib/pinchflat/media/media.ex

@@ -23,8 +23,22 @@ defmodule Pinchflat.Media do
 
   Returns [%MediaItem{}, ...].
   """
-  def list_media_items do
-    Repo.all(MediaItem)
+  def list_media_items(opts \\ []) do
+    limit = Keyword.get(opts, :limit, 50)
+    offset = Keyword.get(opts, :offset, 0)
+    downloaded_only = Keyword.get(opts, :downloaded_only, false)
+
+    query =
+      from(mi in MediaItem, limit: ^limit, offset: ^offset, order_by: [desc: mi.uploaded_at])
+
+    query =
+      if downloaded_only do
+        from(mi in query, where: not is_nil(mi.media_downloaded_at))
+      else
+        query
+      end
+
+    Repo.all(query)
   end
 
   @doc """
@@ -72,8 +86,27 @@ defmodule Pinchflat.Media do
 
   Returns [%MediaItem{}, ...].
   """
-  def list_media_items_for_source(source_id) do
-    Repo.all(from mi in MediaItem, where: mi.source_id == ^source_id)
+  def list_media_items_for_source(source_id, opts \\ []) do
+    limit = Keyword.get(opts, :limit, 50)
+    offset = Keyword.get(opts, :offset, 0)
+    downloaded_only = Keyword.get(opts, :downloaded_only, false)
+
+    query =
+      from(mi in MediaItem,
+        where: mi.source_id == ^source_id,
+        limit: ^limit,
+        offset: ^offset,
+        order_by: [desc: mi.uploaded_at]
+      )
+
+    query =
+      if downloaded_only do
+        from(mi in query, where: not is_nil(mi.media_downloaded_at))
+      else
+        query
+      end
+
+    Repo.all(query)
   end
 
   @doc """

lib/pinchflat/settings/setting.ex

@@ -17,7 +17,8 @@ defmodule Pinchflat.Settings.Setting do
     :youtube_api_key,
     :extractor_sleep_interval_seconds,
     :download_throughput_limit,
-    :restrict_filenames
+    :restrict_filenames,
+    :api_token
   ]
 
   @required_fields [
@@ -40,6 +41,7 @@ defmodule Pinchflat.Settings.Setting do
     # This is a string because it accepts values like "100K" or "4.2M"
     field :download_throughput_limit, :string
     field :restrict_filenames, :boolean, default: false
+    field :api_token, :string
 
     field :video_codec_preference, :string
     field :audio_codec_preference, :string

lib/pinchflat_web/api_auth_plug.ex

@@ -2,10 +2,9 @@ defmodule PinchflatWeb.ApiAuthPlug do
   @moduledoc """
   Authenticates API requests using a Bearer token.
 
-  The token is read from the `PINCHFLAT_API_TOKEN` environment variable.
-  If the environment variable is not set, API authentication is disabled
-  (useful for development and testing). In production, you should always
-  set this to a secure value.
+  The token is stored in the settings database and managed via the web UI.
+  A token must be generated before API access is possible — the API is
+  always authenticated, there is no open-access mode.
 
   Clients should send the token in the Authorization header:
     Authorization: Bearer <token>
@@ -17,7 +16,7 @@ defmodule PinchflatWeb.ApiAuthPlug do
   def init(opts), do: opts
 
   def call(conn, _opts) do
-    expected_token = Application.get_env(:pinchflat, :api_token)
+    expected_token = Settings.get!(:api_token)
 
     if credential_set?(expected_token) do
       case get_req_header(conn, "authorization") do
@@ -32,8 +31,8 @@ defmodule PinchflatWeb.ApiAuthPlug do
           send_unauthorized(conn)
       end
     else
-      # No API token configured — allow access (dev/test mode)
-      conn
+      # No API token has been generated yet — deny all access
+      send_unauthorized(conn, "API token not configured. Generate one in Settings.")
     end
   end
 
@@ -41,10 +40,10 @@ defmodule PinchflatWeb.ApiAuthPlug do
     credential && credential != ""
   end
 
-  defp send_unauthorized(conn) do
+  defp send_unauthorized(conn, message \\ "Unauthorized") do
     conn
     |> put_resp_content_type("application/json")
-    |> send_resp(401, ~s({"errors":{"detail":"Unauthorized"}}))
+    |> send_resp(401, ~s({"errors":{"detail":"#{message}"}}))
     |> halt()
   end
-end
+end

lib/pinchflat_web/controllers/api/v1/api_media_item_controller.ex

@@ -9,17 +9,20 @@ defmodule PinchflatWeb.Api.V1.ApiMediaItemController do
 
   alias Pinchflat.Repo
   alias Pinchflat.Media
-  alias Pinchflat.Media.MediaItem
   alias Pinchflat.Downloading.MediaDownloadWorker
 
   def index(conn, params) do
+    limit = parse_param(params, "limit", 50)
+    offset = parse_param(params, "offset", 0)
+    downloaded_only = params["downloaded"] == "true"
+
     media_items =
       case params do
         %{"source_id" => source_id} ->
-          Media.list_media_items_for_source(source_id)
+          Media.list_media_items_for_source(source_id, limit: limit, offset: offset, downloaded_only: downloaded_only)
 
         _ ->
-          Media.list_media_items()
+          Media.list_media_items(limit: limit, offset: offset, downloaded_only: downloaded_only)
       end
 
     media_items = Repo.preload(media_items, :source)
@@ -94,4 +97,17 @@ defmodule PinchflatWeb.Api.V1.ApiMediaItemController do
       end)
     end)
   end
-end
+
+  defp parse_param(params, key, default) do
+    case Map.get(params, key) do
+      nil ->
+        default
+
+      value ->
+        case Integer.parse(value) do
+          {n, _} -> n
+          :error -> default
+        end
+    end
+  end
+end

lib/pinchflat_web/controllers/api/v1/api_media_profile_controller.ex

@@ -6,7 +6,6 @@ defmodule PinchflatWeb.Api.V1.ApiMediaProfileController do
   use PinchflatWeb, :controller
 
   alias Pinchflat.Profiles
-  alias Pinchflat.Profiles.MediaProfile
 
   def index(conn, _params) do
     json(conn, %{data: Profiles.list_media_profiles()})
@@ -65,4 +64,4 @@ defmodule PinchflatWeb.Api.V1.ApiMediaProfileController do
       end)
     end)
   end
-end
+end

lib/pinchflat_web/controllers/api/v1/api_setting_controller.ex

@@ -53,4 +53,4 @@ defmodule PinchflatWeb.Api.V1.ApiSettingController do
       end)
     end)
   end
-end
+end

lib/pinchflat_web/controllers/api/v1/api_source_controller.ex

@@ -9,7 +9,6 @@ defmodule PinchflatWeb.Api.V1.ApiSourceController do
 
   alias Pinchflat.Repo
   alias Pinchflat.Sources
-  alias Pinchflat.Sources.Source
   alias Pinchflat.Tasks
   alias Pinchflat.Downloading.DownloadingHelpers
   alias Pinchflat.SlowIndexing.SlowIndexingHelpers
@@ -43,6 +42,7 @@ defmodule PinchflatWeb.Api.V1.ApiSourceController do
     case Sources.create_source(source_params) do
       {:ok, source} ->
         source = Repo.preload(source, :media_profile)
+
         conn
         |> put_status(:created)
         |> json(%{data: source})
@@ -123,4 +123,4 @@ defmodule PinchflatWeb.Api.V1.ApiSourceController do
       end)
     end)
   end
-end
+end

lib/pinchflat_web/controllers/api/v1/api_task_controller.ex

@@ -15,6 +15,7 @@ defmodule PinchflatWeb.Api.V1.ApiTaskController do
       case params do
         %{"source_id" => source_id} ->
           source = Pinchflat.Sources.get_source!(source_id)
+
           Tasks.list_tasks_for(source)
           |> Repo.preload(:job)
 
@@ -30,4 +31,4 @@ defmodule PinchflatWeb.Api.V1.ApiTaskController do
     task = Tasks.get_task!(id) |> Repo.preload(:job)
     json(conn, %{data: task})
   end
-end
+end

lib/pinchflat_web/controllers/api/v1/fallback_controller.ex

@@ -15,4 +15,4 @@ defmodule PinchflatWeb.Api.V1.FallbackController do
     |> put_status(:not_found)
     |> json(%{errors: %{detail: "Not found"}})
   end
-end
+end

lib/pinchflat_web/controllers/settings/setting_controller.ex

@@ -28,6 +28,36 @@ defmodule PinchflatWeb.Settings.SettingController do
     render(conn, "app_info.html")
   end
 
+  def generate_api_token(conn, _params) do
+    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
+
+    case Settings.set(api_token: token) do
+      {:ok, _} ->
+        conn
+        |> put_flash(:info, "API token generated successfully.")
+        |> redirect(to: ~p"/settings")
+
+      {:error, _} ->
+        conn
+        |> put_flash(:error, "Failed to generate API token.")
+        |> redirect(to: ~p"/settings")
+    end
+  end
+
+  def revoke_api_token(conn, _params) do
+    case Settings.set(api_token: nil) do
+      {:ok, _} ->
+        conn
+        |> put_flash(:info, "API token revoked.")
+        |> redirect(to: ~p"/settings")
+
+      {:error, _} ->
+        conn
+        |> put_flash(:error, "Failed to revoke API token.")
+        |> redirect(to: ~p"/settings")
+    end
+  end
+
   def download_logs(conn, _params) do
     log_path = Application.get_env(:pinchflat, :log_path)
 

lib/pinchflat_web/controllers/settings/setting_html/setting_form.html.heex

@@ -26,6 +26,59 @@
     )}
   </section>
 
+  <section class="mt-8">
+    <h3 class="text-2xl text-black dark:text-white">
+      API Access
+    </h3>
+    <p class="text-sm mt-2 max-w-prose text-bodydark2">
+      Generate a token to authenticate requests to the <code class="font-mono">/api/v1</code> REST API.
+      Required for MCP server integration and other programmatic clients.
+      Send it as <code class="font-mono">Authorization: Bearer &lt;token&gt;</code>.
+    </p>
+
+    <div class="mt-4" x-data="{ revealed: false, copied: false }">
+      <%= if Settings.get!(:api_token) do %>
+        <% token = Settings.get!(:api_token) %>
+        <div class="flex items-center gap-3 flex-wrap">
+          <code class="font-mono text-sm bg-meta-2 dark:bg-meta-4 px-3 py-2 rounded break-all">
+            <span x-show="!revealed">{String.slice(token, 0, 12)}••••••••</span>
+            <span x-show="revealed" x-cloak>{token}</span>
+          </code>
+          <button type="button" class="text-sm underline" @click="revealed = !revealed">
+            <span x-show="!revealed">Show</span>
+            <span x-show="revealed" x-cloak>Hide</span>
+          </button>
+          <button
+            type="button"
+            class="text-sm underline"
+            data-token={token}
+            @click="navigator.clipboard.writeText($el.dataset.token).then(() => { copied = true; setTimeout(() => copied = false, 2000) })"
+          >
+            <span x-show="!copied">Copy</span>
+            <span x-show="copied" x-cloak>Copied!</span>
+          </button>
+          <.link href={~p"/settings/generate_api_token"} method="post">
+            <.button rounding="rounded-lg" class="bg-warning hover:bg-warning/80">Regenerate Token</.button>
+          </.link>
+          <.link
+            href={~p"/settings/revoke_api_token"}
+            method="post"
+            data-confirm="Are you sure? This will immediately disable all API access."
+          >
+            <.button rounding="rounded-lg" class="bg-danger hover:bg-danger/80">Revoke Token</.button>
+          </.link>
+        </div>
+      <% else %>
+        <p class="text-sm text-danger mb-3">
+          No API token configured. The API is currently inaccessible.
+        </p>
+        <.link href={~p"/settings/generate_api_token"} method="post">
+          <.button rounding="rounded-lg" class="bg-primary hover:bg-primary/80">Generate API Token</.button>
+        </.link>
+      <% end %>
+    </div>
+  </section>
+
   <section class="mt-8">
     <section>
       <h3 class="text-2xl text-black dark:text-white">

lib/pinchflat_web/router.ex

@@ -52,6 +52,8 @@ defmodule PinchflatWeb.Router do
     resources "/search", Searches.SearchController, only: [:show], singleton: true
 
     resources "/settings", Settings.SettingController, only: [:show, :update], singleton: true
+    post "/settings/generate_api_token", Settings.SettingController, :generate_api_token
+    post "/settings/revoke_api_token", Settings.SettingController, :revoke_api_token
     get "/app_info", Settings.SettingController, :app_info
     get "/download_logs", Settings.SettingController, :download_logs
 

priv/repo/migrations/20260704114239_add_api_token_to_settings.exs

@@ -0,0 +1,9 @@
+defmodule Pinchflat.Repo.Migrations.AddApiTokenToSettings do
+  use Ecto.Migration
+
+  def change do
+    alter table(:settings) do
+      add :api_token, :string
+    end
+  end
+end

test/pinchflat_web/api_auth_plug_test.exs

@@ -2,24 +2,34 @@ defmodule PinchflatWeb.ApiAuthPlugTest do
   use PinchflatWeb.ConnCase
 
   import Pinchflat.ProfilesFixtures
+  alias Pinchflat.Settings
 
   setup do
-    # Ensure api_token is not set by default in tests
-    Application.put_env(:pinchflat, :api_token, nil)
+    # Ensure api_token is cleared in DB for each test
+    Settings.set(api_token: nil)
     :ok
   end
 
   describe "when no api_token is configured" do
-    test "allows access without Authorization header", %{conn: conn} do
+    test "returns 401 without Authorization header", %{conn: conn} do
       conn = get(conn, ~p"/api/v1/media_profiles")
-      assert %{status: 200} = conn
+
+      assert %{status: 401} = conn
+    end
+
+    test "returns 401 even with a Bearer token", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("authorization", "Bearer some-token")
+        |> get(~p"/api/v1/media_profiles")
+
+      assert %{status: 401} = conn
     end
   end
 
   describe "when api_token is configured" do
     setup do
-      Application.put_env(:pinchflat, :api_token, "secret-token-123")
-      on_exit(fn -> Application.put_env(:pinchflat, :api_token, nil) end)
+      Settings.set(api_token: "secret-token-123")
       :ok
     end
 
@@ -62,4 +72,4 @@ defmodule PinchflatWeb.ApiAuthPlugTest do
       assert %{status: 200} = conn
     end
   end
-end
+end

test/pinchflat_web/controllers/api/v1/api_media_item_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiMediaItemControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.MediaFixtures
   import Pinchflat.SourcesFixtures
   import Pinchflat.ProfilesFixtures
@@ -77,4 +87,4 @@ defmodule PinchflatWeb.Api.V1.ApiMediaItemControllerTest do
       assert [_] = all_enqueued(worker: MediaDownloadWorker)
     end
   end
-end
+end

test/pinchflat_web/controllers/api/v1/api_media_profile_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiMediaProfileControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.ProfilesFixtures
 
   describe "GET /api/v1/media_profiles" do
@@ -28,7 +38,10 @@ defmodule PinchflatWeb.Api.V1.ApiMediaProfileControllerTest do
 
   describe "POST /api/v1/media_profiles" do
     test "creates a media profile and returns 201", %{conn: conn} do
-      conn = post(conn, ~p"/api/v1/media_profiles", media_profile: %{name: "Test Profile", output_path_template: "{{title}}.{{ext}}"})
+      conn =
+        post(conn, ~p"/api/v1/media_profiles",
+          media_profile: %{name: "Test Profile", output_path_template: "{{title}}.{{ext}}"}
+        )
 
       assert %{status: 201} = conn
       assert json_response(conn, 201)["data"]["name"] == "Test Profile"
@@ -40,4 +53,4 @@ defmodule PinchflatWeb.Api.V1.ApiMediaProfileControllerTest do
       assert %{status: 422} = conn
     end
   end
-end
+end

test/pinchflat_web/controllers/api/v1/api_setting_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiSettingControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.ProfilesFixtures
 
   alias Pinchflat.Settings
@@ -42,4 +52,4 @@ defmodule PinchflatWeb.Api.V1.ApiSettingControllerTest do
       assert data["environment"] != nil
     end
   end
-end
+end

test/pinchflat_web/controllers/api/v1/api_source_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiSourceControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.MediaFixtures
   import Pinchflat.SourcesFixtures
   import Pinchflat.ProfilesFixtures
@@ -184,4 +194,4 @@ defmodule PinchflatWeb.Api.V1.ApiSourceControllerTest do
        playlist_title: "some playlist name"
      })}
   end
-end
+end

test/pinchflat_web/controllers/api/v1/api_task_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiTaskControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.SourcesFixtures
   import Pinchflat.MediaFixtures
 
@@ -45,4 +55,4 @@ defmodule PinchflatWeb.Api.V1.ApiTaskControllerTest do
       assert json_response(conn, 200)["data"]["id"] == task.id
     end
   end
-end
+end