Managing API keys
Keys are managed in the MineTech portal under Developers → API Keys. They cannot be managed through the API — a key can never mint or modify another key, so a leaked credential cannot escalate itself.
Issuing
Choose an environment, a name that identifies the workload (erp-sync, not key 1),
and the narrowest scopes that work. Optionally set an expiry.
You are shown the key and its signing secret once. Store both before closing; neither can be retrieved later. The dialog offers a downloadable credentials file that also records the signing scheme.
Storage
Store keys in your platform's secret manager, not in source control, CI variables
that log their values, or an .env committed by accident.
MineTech stores only a bcrypt hash — we cannot show you a key again or recover one.
Rotating
Rotation issues the replacement before revoking the old key, so there is never a window without a working credential. The old key stops working the moment rotation completes, so:
- Rotate in the portal.
- Deploy the new key and secret.
- Confirm traffic is flowing on the new key (Usage tab).
Rotation also mints a new signing secret — update both.
Rotate on a schedule, and immediately if a key may have been exposed.
Revoking
Revocation is immediate and permanent. A revoked key can be deleted afterwards to tidy the list; deletion is only permitted after revocation, so removing a row can never itself cause an outage.
Monitoring
The Usage tab shows request volume, success rate, latency and the endpoints a key calls most. Two things worth watching:
- A key with no traffic for 90 days is probably orphaned — revoke it.
- A key approaching expiry needs rotating before it stops working.
Both are surfaced as advisories in the portal.
If a key is compromised
- Revoke it — do not wait for a rotation window.
- Issue a replacement with the same scopes and deploy.
- Review the Usage tab for unexpected endpoints or volume.
- Check the audit log — every issue, rotation and revocation is recorded with the actor.