API Keys

Scoped to one project and one environment, hashed at rest, revocable in one click. Treat them like passwords that happen to start with calder_sk_.

Test vs. live

Test keys (calder_sk_test_…) run the entire pipeline — validation, queue, provider simulation, events, webhooks — without delivering anything real or metering anything. Live keys (calder_sk_live_…) deliver for real. Same code, different key, zero surprises.

Creation

Create keys per project in the dashboard. The secret is shown once — we store only the hash, so a lost key can’t be recovered, only replaced. Name keys after their purpose (production-web, not key-3).

Rotation

Create the replacement, deploy it, verify traffic, then revoke the old one. Overlap is intentional — rotation should never require downtime or a 3am deploy.

Revocation

Revoked keys fail closed immediately. If a key leaks, revoke first and investigate second — then check the event history for anything sent while it was exposed.