private CreateHashedApiKeyRequest ensureExpireTimeEpochMs(final CreateHashedApiKeyRequest request) {
        final AuthenticationConfig authenticationConfig = authenticationConfigProvider.get();
        final Duration maxApiKeyExpiryAge = authenticationConfig.getMaxApiKeyExpiryAge()
                .getDuration();

        final Long expireTimeEpochMs = request.getExpireTimeMs();
        final Instant now = Instant.now();
        final long maxExpireTimeEpochMs = now
                .plus(maxApiKeyExpiryAge)
                .plusSeconds(60) // Add 60s to allow for time elapsed since req was created
                .toEpochMilli();

        if (expireTimeEpochMs != null) {
            if (expireTimeEpochMs < now.toEpochMilli()) {
                throw new RuntimeException(LogUtil.message("Requested key expireTime {} is in the past.",
                        Instant.ofEpochMilli(expireTimeEpochMs)));
            }
            if (expireTimeEpochMs > maxExpireTimeEpochMs) {
                throw new RuntimeException(LogUtil.message("Requested key expireTime {} ({}) is after the configured " +
                                                           "maximum expireTime {} ({})",
                        Instant.ofEpochMilli(expireTimeEpochMs),
                        Duration.ofMillis(expireTimeEpochMs - now.toEpochMilli()),
                        Instant.ofEpochMilli(maxExpireTimeEpochMs),
                        maxApiKeyExpiryAge));
            }
            return request;
        } else {
            final long expireTimeEpochMs2 = Instant.now()
                    .plus(maxApiKeyExpiryAge)
                    .toEpochMilli();
            return CreateHashedApiKeyRequest.builder(request)
                    .withExpireTimeMs(expireTimeEpochMs2)
                    .build();
        }
    }
Fetch the verified {@link UserIdentity} for the passed API key.
If the hash of the API key matches one in the database and that key is enabled
and not expired then the {@link UserIdentity} will be returned, else an empty {@link Optional}
is returned.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/apikey/ApiKeyService.java