API keys
Each customer API key belongs to one application. It authorizes SDK ingest and application policy checks within that scope. Administrators and authorized Developers manage keys from the application workspace.
Open the application’s key settings
Go to Applications, select the application, then choose Config → Keys. Confirm the application and environment before issuing, rotating, or revoking a key.
The key health overview in Settings identifies keys that need attention and links to their application settings. It does not issue organization-wide credentials or collect key-approval requests.
Protect the key
You can also issue the complete compound key with the signed-in VeriProof CLI:
veriproof keys create APPLICATION_IDReplace APPLICATION_ID with your application’s ID. The CLI uses the same permissions and key service as the portal. It shows the new secret once; keys list returns metadata only.
Store the complete key in your approved secret manager when it is shown. You cannot reveal the saved value again later. Use separate applications and credentials when environments need independent access or data boundaries.
Never place an API key in source code, logs, screenshots, browser code, or package-manager settings. If a key is exposed, revoke it promptly and coordinate replacement with the application owner.
Plan changes with the application owner
Rotation requires updating the secret used by running application instances. Check the previous key’s expiry before starting and verify the replacement after deployment. Revocation can interrupt ingest and policy checks, so confirm which application depends on the key.
- Manage application credentials covers storage, planned rotation, and exposed keys.
- Application keys and environments explains environment separation and SDK configuration.
- API authentication documents authentication headers and application scope.