API key management

Console path

Select an application in Applications and open Credentials → API Keys. Configure allowed scopes when creating a key. Save plaintext shown once in secure backend configuration and inspect actual status/expiry rather than assuming permanent validity.

Use Regenerate to replace a credential or Revoke to invalidate it. Plan configuration changes before regeneration. For a smooth switch, create a second key with the same necessary permissions, migrate callers, then revoke the old key. Do not rotate production credentials merely for testing.

Use X-API-Key and satisfy endpoint identity/scope requirements; see API key authentication.