Application Configuration
The Config tab gives you the setup details for one application, including the installation snippet, environment variables, and application-scoped API keys.
Use this tab to:
- Copy the correct SDK snippet for this application.
- Review which environment variables are required.
- Rotate or create application-scoped API keys.
- Confirm which enrichments and SDK version are active.
Tip: After rotating a key or deploying to a new environment, test connectivity before sending live traffic.
Application Configuration
The Config tab is the implementation handoff for one application. It gives developers and administrators the exact setup details they need without making them search across multiple screens.
Compliance Officers, Business Owners, and Auditors do not see the Config tab. Developers and Administrators can generate and rotate API keys. Governance Engineers can edit the application's AI context fields (business context, risk description, expected outcomes) but cannot create or revoke API keys.
Treat application keys as single-application credentials. Create separate keys for separate environments whenever possible.
The SDK Setup panel shows the exact install command and initialization snippet for this application, including the correct application ID and environment variable names. Copy it directly into your project.
On Production applications, your Config tab is read-only. You can view the current setup details and existing key metadata, but you cannot create, rotate, or revoke keys, and you cannot edit configuration fields. To make a production change, ask your Administrator or submit a write request — they will receive a notification in their Focus Queue.
Your access to the Config tab is focused on the Application Context panel: business context, risk description, expected outcomes, and AI model metadata. Keeping these fields current improves the accuracy of AI-generated policy suggestions.
You can revoke all keys for this application at once from Config → API Keys → Revoke all. Do this immediately if you suspect a key has been compromised. All revocations are logged with your identity and a timestamp.
Common checks
- Is the right application ID in the snippet?
- Are the required environment variables present?
- Does the active key still work?
- Are the expected enrichments enabled?