Key lifecycle

Issuing, replacing and protecting your credentials.

Your API key is issued once at account activation and shown to you once. We do not store a retrievable copy, so it cannot be re-sent to you later.

Replacing a key#

There is one API key per account, issued once at activation. There is no self-service rotation at launch. If a key is lost or exposed, contact your account manager to have it replaced; the old key is revoked and a new one issued. Plan for a brief cutover in which you switch systems to the new key and the old key stops working.

Protecting a key#

• Store the key in a secret manager or environment variable, never in source control.
• Limit which of your systems and staff can read it.
• Log the calls you make with a request identifier, so unusual traffic is visible.
• Use a separate key per environment.