diff --git a/module/Core/src/ShortUrl/Spec/BelongsToApiKey.php b/module/Core/src/ShortUrl/Spec/BelongsToApiKey.php
new file mode 100644
index 00000000..a1059168
--- /dev/null
+++ b/module/Core/src/ShortUrl/Spec/BelongsToApiKey.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Shlinkio\Shlink\Core\ShortUrl\Spec;
+
+use Happyr\DoctrineSpecification\BaseSpecification;
+use Happyr\DoctrineSpecification\Filter\Filter;
+use Happyr\DoctrineSpecification\Spec;
+use Shlinkio\Shlink\Rest\Entity\ApiKey;
+
+class BelongsToApiKey extends BaseSpecification
+{
+    private ApiKey $apiKey;
+    private string $dqlAlias;
+
+    public function __construct(ApiKey $apiKey, ?string $dqlAlias = null)
+    {
+        $this->dqlAlias = $dqlAlias ?? 's';
+        $this->apiKey = $apiKey;
+        parent::__construct($this->dqlAlias);
+    }
+
+    protected function getSpec(): Filter
+    {
+        return Spec::eq('authorApiKey', $this->apiKey, $this->dqlAlias);
+    }
+}
diff --git a/module/Core/src/ShortUrl/Spec/BelongsToDomain.php b/module/Core/src/ShortUrl/Spec/BelongsToDomain.php
new file mode 100644
index 00000000..27f93665
--- /dev/null
+++ b/module/Core/src/ShortUrl/Spec/BelongsToDomain.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Shlinkio\Shlink\Core\ShortUrl\Spec;
+
+use Happyr\DoctrineSpecification\BaseSpecification;
+use Happyr\DoctrineSpecification\Filter\Filter;
+use Happyr\DoctrineSpecification\Spec;
+
+class BelongsToDomain extends BaseSpecification
+{
+    private int $domainId;
+    private string $dqlAlias;
+
+    public function __construct(int $domainId, ?string $dqlAlias = null)
+    {
+        $this->domainId = $domainId;
+        $this->dqlAlias = $dqlAlias ?? 's';
+        parent::__construct($this->dqlAlias);
+    }
+
+    protected function getSpec(): Filter
+    {
+        return Spec::eq('domain', $this->domainId, $this->dqlAlias);
+    }
+}
diff --git a/module/Rest/src/ApiKey/Role.php b/module/Rest/src/ApiKey/Role.php
new file mode 100644
index 00000000..1140f1ff
--- /dev/null
+++ b/module/Rest/src/ApiKey/Role.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Shlinkio\Shlink\Rest\ApiKey;
+
+use Happyr\DoctrineSpecification\Spec;
+use Happyr\DoctrineSpecification\Specification\Specification;
+use Shlinkio\Shlink\Core\ShortUrl\Spec\BelongsToApiKey;
+use Shlinkio\Shlink\Core\ShortUrl\Spec\BelongsToDomain;
+use Shlinkio\Shlink\Rest\Entity\ApiKeyRole;
+
+class Role
+{
+    public const AUTHORED_SHORT_URLS = 'AUTHORED_SHORT_URLS';
+    public const DOMAIN_SPECIFIC = 'DOMAIN_SPECIFIC';
+
+    public static function toSpec(ApiKeyRole $role): Specification
+    {
+        if ($role->name() === self::AUTHORED_SHORT_URLS) {
+            return new BelongsToApiKey($role->apiKey());
+        }
+
+        if ($role->name() === self::DOMAIN_SPECIFIC) {
+            return new BelongsToDomain($role->meta()['domain_id'] ?? -1);
+        }
+
+        return Spec::andX();
+    }
+}
diff --git a/module/Rest/src/Entity/ApiKey.php b/module/Rest/src/Entity/ApiKey.php
index bf1baccf..6c122494 100644
--- a/module/Rest/src/Entity/ApiKey.php
+++ b/module/Rest/src/Entity/ApiKey.php
@@ -11,6 +11,7 @@ use Happyr\DoctrineSpecification\Spec;
 use Happyr\DoctrineSpecification\Specification\Specification;
 use Ramsey\Uuid\Uuid;
 use Shlinkio\Shlink\Common\Entity\AbstractEntity;
+use Shlinkio\Shlink\Rest\ApiKey\Role;
 
 class ApiKey extends AbstractEntity
 {
@@ -69,6 +70,7 @@ class ApiKey extends AbstractEntity
 
     public function spec(): Specification
     {
-        return Spec::andX();
+        $specs = $this->roles->map(fn (ApiKeyRole $role) => Role::toSpec($role));
+        return Spec::andX(...$specs);
     }
 }
diff --git a/module/Rest/src/Entity/ApiKeyRole.php b/module/Rest/src/Entity/ApiKeyRole.php
index 6af3d328..aefda970 100644
--- a/module/Rest/src/Entity/ApiKeyRole.php
+++ b/module/Rest/src/Entity/ApiKeyRole.php
@@ -28,4 +28,9 @@ class ApiKeyRole extends AbstractEntity
     {
         return $this->meta;
     }
+
+    public function apiKey(): ApiKey
+    {
+        return $this->apiKey;
+    }
 }