API Key Handling

API key secrets are generated using cryptographically secure randomness. The full credential is returned only during issuance. Later key listings expose only a non-secret prefix for identification.

The backend stores a one-way hash used to validate presented credentials. Keys can be restricted by scope and expiration and can be revoked by their owner. A revoked key cannot be restored.

Consumers should store keys in a secret manager, redact authorization headers from logs, use separate credentials per environment, and revoke a key immediately after suspected exposure.