Manage application credentials
VeriProof application credentials authorize SDK ingest and application policy checks. Treat them like other production service credentials.
Store the key
- Open the application’s API key workspace in the VeriProof portal.
- Generate or rotate the application key.
- Copy the complete value when it is shown.
- Store it in your organization’s secret manager.
- Inject it at runtime as
VERIPROOF_API_KEY, or use the credential-provider option supported by your SDK.
Use your organization’s approved secret manager. Restrict access to the application identity and authorized credential administrators.
Never put credentials in source files, browser code, screenshots, or logs. Keep the complete key intact; do not split or reconstruct it by hand.
Separate environments
Create a separate VeriProof application and credential for development, staging, and production. This limits the effect of a compromised key and keeps test sessions out of production evidence.
Plan a key rotation
Check when rotation invalidates the previous key before changing a running application. Do not assume both keys remain valid during deployment. Coordinate a maintenance window if the change requires an interruption.
Create the replacement
Generate or rotate the application key in the portal and store the new value.
Deploy the replacement
Update the secret reference used by the application. Do not place the key in a deployment manifest or source file.
Confirm the connection
Use an approved test session and confirm it appears in SDK Health for the intended application and environment. Check each running instance for authentication errors. If the application checks policy at runtime, verify that path too.
Revoke the old key
If the previous credential remains active, revoke it after every running instance uses the replacement.
Respond to an exposed key
Treat a key shared in source control, logs, or chat as compromised. Revoke it promptly and follow your organization’s incident procedure. Do not wait for the routine rotation window.
Coordinate with the application owner: revocation can interrupt ingest and policy checks. Deploy a replacement from the secret manager, verify the affected paths, and review activity during the exposure period.
Use the smallest scope
Use an application-scoped key for SDK ingest and policy checks. Grant portal users only the capability they need to manage credentials, and review access when team responsibilities change.