Key lifecycle

A key moves through a small set of states. Manage them at Developer → API Keys (/settings/api-keys).

Status: active or disabled

A key's status is active or disabled. Only an active key authenticates — flipping a key to disabled stops it from authenticating immediately, and flipping it back to active restores it. Use disabled to pause a key without destroying it.

Expiry

A key may carry an expires_at timestamp. Once that instant passes, the key no longer authenticates — every request returns the opaque 401 (see API keys). Leave expires_at unset for a non-expiring key.

Rotate

Rotating a key issues a new secret while preserving the key's identity (its row, scopes, and settings). The old secret stops authenticating the moment the rotation commits, so rotate when a secret may have leaked. The new sk_live_… token is revealed once — copy it immediately.

# Rotate from the dashboard, then update your stored secret with the newly revealed token.

Revoke

Revoking a key permanently stops it from authenticating — it cannot be un-revoked. Revoke a key you no longer need or that you believe is compromised beyond a rotation.