Your customers' API keys
How customers of your API get keys: issued in the Portal, scoped to Verbs, test or live, rolled without downtime and revoked on the next call.
Every Customer of your API signs its calls with an API Key your Startup issues. Customers make their own keys in the Portal, so key requests never reach your inbox.
What a customer gets
| In the Portal | What it does |
|---|---|
| Keys screen | Make, name, scope, roll and revoke keys, with each key's last use |
test and live keys | A test key reaches test records and moves no money |
| Request log | Every call in the last 30 days, with its key, status and the error that names the fix |
| Usage | Calls against each Limit on their plan, with the reset time |
A key carries your brand prefix, such as leaseline_sk_live_, ahead of a fixed pattern. Code scanners recognize a leaked key from any Startup with one rule. The full secret shows once, at issue; after that only the prefix does.
Scope
A key reaches one Customer's Tenant and nothing else. Its verbs narrow it further: a nightly sync key that may call only Collection.query cannot write, even if the plan allows writes.
A key never reaches past its Customer's plan. Unset verbs means every Verb the plan's Entitlements grant, and an upgrade widens every such key on the next call.
Tell customers to make one key per job: one for the sync, one for the dashboard, one for each agent. A leak then costs one job, and the request log says which.
Roll and revoke
| To | Call | What happens |
|---|---|---|
| Replace a key without downtime | APIKey.roll | A new key with the same scope; the old one works until expireIn, 24 hours by default |
| Stop a key now | APIKey.revoke | The next call returns 401 unauthorized |
The platform watches public code and pages for live keys. A leaked key is revoked within minutes, and the Customer's admins get an email to roll a replacement. Your agent can do it for them: replace a leaked key.
Keys for agents
An agent that buys from your API needs no key from a person. It accepts the Offer named in the 402 reply, pays under its own Mandate, and retries the call. Selling to agents covers the flow.
Next
- API plans, limits and uptime: what each key's plan allows.
- Keys: the platform's own keys, which your agents and code use.