Overview
Hosted application traffic should use database-scoped keys.
Keys are shown once and stored hashed at rest.
Database-scoped keys pin SQL and capability calls to a runtime branch and reject branch overrides.
For production-hardened environments, key creation can require expires_at as Unix epoch seconds so stale application credentials fail closed.
Developer notes
- Rotate keys when a developer or deployment is offboarded.
- Use one key per app environment.
- Prefer database-scoped keys over project-wide keys.
- Set an expiration for production keys and rotate before expires_at.
- Never put API keys in browser code.