Manage API Keys Safely

Deliverlens customer API keys are shown in plaintext once. After creation, only the hash is stored, so rotation and naming matter.

  1. Create a key with a descriptive name tied to one integration.
  2. Copy it immediately into the destination secret manager.
  3. Verify the integration can create tests successfully.
  4. Revoke old keys only after the replacement is confirmed live.

Good naming patterns

  • ci-staging
  • marketing-automation
  • woocommerce-prod
  • support-tools

When to rotate a key

  • A teammate copied it into an insecure place
  • An integration owner changed
  • A production incident suggests accidental exposure
  • You no longer know which system is using it

Important behavior

  • Invalid keys do not break public test creation; the request falls back to the public flow.
  • Revoked keys stop authenticating immediately.
  • The key value cannot be recovered later from the database.

Operational guardrails

  • One key per integration, not one shared key for everything.
  • Store keys in environment variables or a secret manager, never in client-side code.
  • Revoke unused keys during periodic cleanup.

If an integration suddenly creates public tests instead of customer-linked tests, verify the key header value first before debugging the rest of the request.