API keys

A key authenticates a caller to your API, at the gateway, before the request reaches your upstream.

The important part is where the policy comes from: the gateway enforces a key on an operation because your document's security says so. We did not invent a policy language for you to learn, and there is no separate table of rules to drift out of sync with the contract. An operation with no security requirement stays open, because that is what your document says about it.

# in your openapi.yamlcomponents  securitySchemes    apiKey: { type: apiKey, in: header, name: X-API-Keysecurity  - apiKey: []          # ...or per operation

The secret is shown once

At issuance, and never again. We store its SHA-256 and the first few characters, so a key we could show you twice would be a key a database dump could show anyone.

The prefix is kept in clear so you can recognise a key in a list - and in your own logs - without being able to reconstruct it from one.

Revocation

Immediate in intent and quick in practice: the key drops out of the registry feed, and the fleet stops honouring it on its next poll. The row stays for the audit trail, so "when was this revoked and by whom" remains answerable.

Rates

A key may carry a per-minute rate limit. Zero means unlimited. The limit is enforced per key per operation at the edge, and it survives a publish

• changing your document does not reset anybody's counter.

Environments

A key belongs to an environment (production by default), which is how a staging key stops working against production traffic without anybody having to remember to make that true.

Not to be confused with

• The report token, which is how your self-hosted gateway authenticates to us when it ships drift. One per proxy, rotatable on the proxy page.
• The account API token, which is what the apip CLI carries. See The API and the CLI.