Skip to Content
Getting startedApplication keys and environments

Application keys and environments

Use a separate VeriProof application and key for each environment that needs an independent access, data, or retention boundary.

The portal demo is read-only. It does not accept SDK traffic or provide a shared demo API key.

Configure the SDK

The application setup view provides the endpoint, application identifier, and key required by the selected SDK.

VERIPROOF_API_KEY=vp_cust_<issued-key>
VERIPROOF_ENDPOINT=https://<approved-ingest-host>

Use the exact variable or option names documented for your SDK package. The public SDK contract supports an endpoint override for Customer-managed Azure.

Treat the full application key as a secret. Do not place it in source control, browser code, logs, tickets, or documentation.

Issue a key

Open the application and choose Config → Keys. Confirm its environment before issuing a key. If an active key already exists, review its status and use rotation when a replacement is needed.

The secret is shown during issuance. Store it in the approved secret manager before leaving the workflow.

Rotate a key

For a planned rotation, coordinate with the application owner and check when the previous key stops working.

  1. Rotate the key from the intended application’s Config → Keys tab.
  2. Store it in the secret manager.
  3. Update and deploy the application configuration.
  4. Send a representative test session.
  5. Confirm the new key reports to the intended application.
  6. Confirm the previous key is retired or reaches its stated expiry.

Do not assume old and new values remain valid indefinitely. Follow credential rotation guidance to coordinate the change.

If a key is exposed, revoke it promptly under your incident procedure. Do not wait for routine rotation or a successful replacement test.

Revoke a key

Revoke a key when its owner, application, environment, or workload no longer needs access. Requests that use a revoked key are rejected.

Investigate unexpected key use before issuing a replacement. Review the affected environment and audit records.

Environment checklist

  • Each environment has the intended VeriProof application and key.
  • The endpoint belongs to the approved deployment.
  • Secrets are stored outside source code and build output.
  • Test records contain no live customer data unless the environment is approved for it.
  • Reporting is verified before broader use.
  • Rotation and revocation ownership is documented.
Last updated on
First integrationExplore the demo