Rolling an API Key issues a replacement with the same name and scope; the old key works for an hour while the new one deploys. The Customer's admins see the new secret once.

Needs Ship an API

What you get

1new key with the same name and scope, its secret shown onceAPI Key
1old key that stops working in one hourAPI Key
1email to the customer’s admins naming the key and when the old one stopsMessage

Your agent does

APIKey.roll

You, to your agent

A customer posted their API key in public, replace it.

Roll a leaked key.

Kill that key and give them a new one.

# APIKey.roll
curl -X POST https://api.sb/leaseline.app/api-keys/api_key_nightly_sync/roll \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"expireIn":"1h"}'

import { $ } from 'startup-builder'

await $.APIKey.roll({ apiKey: 'api_key_nightly_sync', expireIn: '1h' })

npx startup-builder do APIKey.roll --json '{"apiKey":"api_key_nightly_sync","expireIn":"1h"}'

{
  "name": "do",
  "arguments": {
    "code": "return await $.APIKey.roll({ apiKey: 'api_key_nightly_sync', expireIn: '1h' })"
  }
}

Change it

Stop the old key now, not in an hour.
Show me every key this customer has.
Let the new key read only.

Under the hood

Systems
Nouns: API Key, Tenant, Customer
Events: APIKey.rolled

Replace a leaked key

What you get

Your agent does

Change it

Under the hood

Contents

What you getCopy Anchor Link

Your agent doesCopy Anchor Link

Change itCopy Anchor Link

Under the hoodCopy Anchor Link

What you get

Your agent does

Change it

Under the hood