Laboratory › Developers › API keys
API keys
There is nothing to authenticate to. A key issuer with no protected resource behind it is a liability with a login page.
There is deliberately no mock key generator on this page. A fake credential UI built to make a portal look finished is how people end up pasting real secrets into something that was never wired up.
The contract it will honour
Written down now, while nothing depends on it, so it cannot be invented differently later under pressure to ship.
- Create with a name, a scope, an environment and an expiry. All four required; none defaults to something permissive.
- The secret is shown exactly once at creation and never again. Only a hash is stored.
- Rotate issues a new secret with an overlap window; revoke takes effect immediately and is not reversible.
- Each key records created-at, created-by, last-used and scope, so an unused key can be found and removed.
- A key never appears in a URL, a log, an example, a screenshot, an analytics payload or version control.
The lifecycle, when it exists
| Step | Rule |
|---|---|
| Create | Name, scope, environment and expiry are all required. None of them defaults to something permissive, and an ambiguous scope fails closed. |
| Reveal | The secret is shown once, at creation. It is never shown again and cannot be recovered — only a hash is stored. Losing it means rotating it. |
| Use | Presented in the Authorization header. Never in a query string: URLs are logged, cached, shared and sent in referrers. |
| Observe | Created-at, created-by, last-used and scope are visible, so a key nobody uses can be found and removed. |
| Rotate | Issues a new secret with a stated overlap window, so rotation does not require an outage. |
| Revoke | Immediate and irreversible. A revoked key is never reinstated; a new one is issued instead. |
Where a key must never appear
- A URL or query string.
- A log line, an analytics payload or an error message — including its prefix or its length.
- Version control, a documentation example, or a screenshot.
- HTML served by this site, under any circumstances.
These are not aspirations to enforce later. They are the reason the key portal does not exist yet: each one is a control that has to be built and tested, and none of them can be added convincingly after a launch.
PreviousAuthentication
NextRate limits