credentials
API keys
Secret keys authenticate every request. Scope them narrowly, rotate them on a schedule, and revoke the moment one leaks — revocations propagate to every edge in under sixty seconds.
active keys
5
3 live · 2 test
revoked · 90d
1
mobile-proto · leaked in CI log
last rotation
12d ago
policy: every 90 days
issued keys
Every credential in your workspace
| name | prefix | env | scopes | last used | status | actions |
|---|---|---|---|---|---|---|
| production-backend | sk-live-9f4K… | live | charges:write,customers:read | 2 minutes ago | active |
Full secrets are shown once at creation. Prefixes are safe to log and to paste into support tickets.
rotation policy
Rotate without downtime
- Rotate every 90 days. The key table flags anything older in amber a week before it lapses.
- Run one active and one pending key during rotation — both authenticate until you cut over, so zero requests drop.
- Scope CI keys to exactly what the pipeline calls. A leaked charges:read key can't move money.
- Revoked keys die at every edge in under 60 seconds — verify with a single curl after you revoke.
recent key activity
Who used what, when
- 21:43:07 UTCproduction-backend · 200 ×412 from 34.102.18.7
- 21:31:52 UTCstaging-ci · 201 ×18 from ci-runner-04
- 18:12:40 UTCanalytics-export · 429 ×3 — burst ceiling hit
- 09:58:11 UTClegacy-importer · last call 26 days ago
- May 02, 14:20mobile-proto · revoked by s. prabhu — leaked in CI log