API keys
API keys authenticate requests to your generated public endpoints. Each project can issue multiple keys. Keys are scoped to a project: a key for project A cannot read or write project B.
How keys are stored
Only the SHA-256 hash is persisted. The plaintext is shown once at creation and never again. Lose it and you'll need to rotate. This is also why EndpointOS staff cannot recover a key for you; there's nothing to recover.
Sending a key
Either header works:
Authorization: Bearer sapi_live_ab12cd34ef56...
x-api-key: sapi_live_ab12cd34ef56...Rotation with grace
Click Rotate on a key to issue a new plaintext while the old key stays valid for a configurable grace window (default 24 hours). Roll out the new key in your clients, watch logs to confirm traffic moved over, then finalize the rotation to revoke the old key. Aborting rotation puts you back to the original key.
Revocation
Click Revoke to immediately invalidate a key. Existing requests in-flight complete; new requests with that key return 401.
Consumer-scoped keys
A key can be attached to a named consumer. Requests made with that key are tagged with the consumer in logs and usage, which lets you see "Ada's traffic this month" without instrumenting your application.