🔑 API keys: one kind of key, multiple active, zero-downtime rotation
- New — up to 5 active API keys per account, created and revoked self-serve from the Console, with zero-downtime rotation and a dedicated
revoked_api_keyerror when a revoked key is used. - Changed — the fixed public key / private key pair is gone. Every API key is now the same kind of key.
⚙️ What Changes
One kind of API key
Your account used to have two fixed credentials in the Console: a public key and a private key. That distinction no longer exists. There is now a single list of API keys, all of the same kind — you create them, label them, and revoke them yourself, and they all authenticate the same way with the X-API-Key header.
The keys you already use keep working and appear in that list, so there is nothing to change in your integration. If one of them is a key you no longer use, revoke it.
Multiple active keys and zero-downtime rotation
You can keep up to 5 API keys active at the same time and manage them from Developers → API keys: create a key with a label, see when it was last used, and revoke it when you no longer need it.
To rotate without interruption: create the new key, deploy it, confirm in Last used that the previous key stopped receiving traffic, and then revoke it. The secret is shown only once, at creation — store it immediately, it cannot be retrieved later.
A revoked key stops authenticating immediately and returns revoked_api_key, which is distinct from an invalid key. At least one active key is required at all times, so the last remaining active key cannot be revoked.