Authentication
How keys are minted, stored and revoked, and why the raw value is shown exactly once.
Every request carries a bearer token:
Authorization: Bearer sk-ww-…
Keys belong to the organization rather than to the person who made them. A teammate leaving does not take production with them, and revoking their account does not revoke the key their service is using.
What a key is
A key is the prefix sk-ww- followed by 24 random bytes, hex encoded. Only its
SHA-256 hash is stored — the raw string is returned once, at creation, and
cannot be read back afterwards.
That is why there is no "show key" button. If a key is lost, revoke it and mint another; there is nothing to recover.
Rotating
Keys are additive, so a rotation needs no downtime:
- Mint the replacement.
- Deploy it.
- Wait for the old key's Last used to stop moving.
- Revoke the old one.
Revocation takes effect on the next request. There is no grace period.
Keep keys server-side. A key in a browser bundle is a key anyone can read, and it can spend the whole balance. If you need to call the gateway from a client, put your own endpoint in front of it.
Scoping by key
Usage is recorded against the key that made the request, so separate keys per environment turn the Usage breakdown into something you can act on — staging quietly burning credit is obvious when it has its own row.