Admin API key lifecycle

Lifecycle phases#

1. Create or identify tenant workspace.
2. Issue scoped key for a workload or integration.
3. Inventory key usage and rotate on schedule.
4. Revoke compromised or expired credentials immediately.

Core admin endpoints#

• Create tenant: POST /admin/tenants
• Issue tenant key: POST /admin/tenants/{tenant_id}/keys
• List keys: GET /admin/tenants/{tenant_id}/keys
• Revoke key: DELETE /admin/keys/{key_id}

Rotation policy#

Use short-lived keys for CI and medium-lived keys for service integrations. Rotate before expiry and monitor active key inventory per tenant to avoid orphaned credentials.