Edit, rotate, and revoke OTOH API keys without exposing their secrets.
Open your profile and go to the API Keys section.
Edit a key
The Edit action can change:
- name;
- expiration period;
- operation scopes;
- allowed projects;
- allowed sensors;
- origins.
The secret is never displayed, returned, changed, or recovered during editing.
You can keep the current expiration date or set a new period of 7, 15, 30, 90, 180, or 365 days from the edit time.
An expired key or a predecessor that has already been rotated cannot be edited. Editing is also unavailable when the owner no longer has access to an API-enabled project.
Changes to scopes and allowed resources take effect immediately. Apply the principle of least privilege and validate integrations after reducing access.
Rotate a key
Rotation creates a successor with a new key ID and secret. The successor copies the predecessor's name, operation scopes, allowed projects and sensors, and origins. Its expiration is set to 90 days.
The new secret is displayed only once. Copy it immediately and store it in a secrets manager.
Rotation intentionally does not revoke the predecessor. This overlap prevents downtime while integrations are migrated:
- Rotate the current key.
- Replace the key in every integration.
- Validate the replacement in production.
- Revoke the predecessor.
Until step 4, both keys continue working independently, subject to their scopes, allowed resources, and expiration dates. There is no automatic overlap deadline: the predecessor remains valid until it is manually revoked or expires.
A predecessor that has already been rotated cannot be edited or rotated again, but it can and should be revoked after migration.
Revoke a key
Revocation is immediate, terminal, and irreversible. Requests using that key start returning 401 Unauthorized.
Revoke a key when:
- migration to its rotated successor is complete;
- the key may have been exposed;
- the integration is retired;
- its access is no longer required.
States and rotation
- Active: the key can authenticate until it expires or is revoked.
- Expired: its expiration date has passed; it can no longer authenticate, be edited, or be rotated.
- Revoked: access was permanently terminated.
- Rotated: a relationship between a predecessor and successor, not a separate authentication status. A rotated predecessor remains active until revoked or expired.
Revoked keys are removed from the active list. Expired keys remain visible for reference.
Secret handling
Never put an API key in a URL, query string, browser code, source control, logs, support tickets, or analytics. Store it in a secrets manager and send it only from trusted backend systems using:
otoh-api-key: Bearer YOUR_API_KEY