Manage API keys for secure access

API keys are created per project and authenticate requests to the Edge API. Each key is associated with a project and grants full access to that project's lookup and export endpoints.

Each key is generated with a recognizable prefix (e.g., redir_live_) for easy identification in code and logs. Keys are stored as salted SHA-256 hashes — the full key is only shown once at creation time and cannot be retrieved afterward.

To rotate a key, create a new key, update your services to use the new key, then revoke the old one. This manual workflow ensures you have full control over the transition process.

API keys provide authentication for the Edge API without exposing your Convex credentials. Each key is scoped to a single project, so a compromised key only affects one project's data. Creating separate keys for different services or environments makes it easy to revoke one without disrupting others.

Last-used timestamps are tracked for each key, helping you identify keys that are no longer in active use. Regular key audits — reviewing last-used dates and revoking unused keys — are a simple way to maintain good security hygiene.

Keys are permanent until manually revoked. When you revoke a key, it is immediately invalidated and can no longer authenticate API requests. The key prefix remains visible in your dashboard for audit purposes even after revocation.