Overview

Create, rotate, scope, and revoke API keys safely.

Audience

• Admin
• It Security

Product Area

Developer

Prerequisites

• Developer permissions

Steps

1. Create scoped key

Issue key with minimum scopes and expiration policy.

1. Rotate and revoke

Rotate active keys and revoke unused credentials quarterly.

Expected Result

The Developer workflow completes without unresolved validation errors, and the result is visible to the intended roles.

Security and Audit Notes

• Use the least-privileged role that can complete the task.
• Confirm the resulting change or decision appears in the workspace audit trail when the workflow changes customer data or access.

Limits and Preconditions

• Available controls depend on the tenant plan, enabled modules, jurisdiction, and administrator policy.
• If a named control is not visible, confirm entitlement and role access before treating the behavior as a product failure.

Troubleshooting

• Key leaked in logs: Revoke immediately and perform log scrub/remediation.

Related Articles

• Security Review Preparation Checklist

Escalation

If the documented result cannot be reached after the checks above, capture the workspace identifier, affected product area, timestamp, and a redacted error message, then use Support. Never include secrets, privileged legal content, or customer documents in the initial report.