Rotating and revoking keys

Rotate a key

Each organisation can have two active keys per environment, so you can swap keys without downtime.

1. Create a new key with the same scopes.
2. Update your system to use the new key.
3. Check the old key's Last used time has stopped changing.
4. Revoke the old key.

Revoke a key

In Settings > Developers > API keys, select the key and choose Revoke. It stops working immediately. Requests that use it get a 401.

Revoking can't be undone. Create a new key if you need access again.

See what a key has done

For each key, Owners can see:

• when it was created, and by whom
• when it was last used
• the last 30 days of requests: time, endpoint, status and request ID

Every change made through the API also appears in StrideHQ's activity log as "via API", with the key's name.

Next steps

• Environments and sandbox: what's in the sandbox and how to move to production.
• Webhooks: get told when things change.
• API reference: every endpoint, field and error.