Managing keys

This guide covers creating, rotating, and revoking API keys in CloudSignal.

Create an API key

Navigate to API Keys

Log into the CloudSignal dashboard.
Go to Settings in the sidebar.
Click on the API Keys tab.

Click Create Key

Click the Create API Key button.

Select key type

Choose the key type based on your use case:

Type	When to use
Publishable (`pk_`)	Client-side code, browser apps
Secret (`sk_`)	Server-side code, automation

Name your key

Give your key a descriptive name that identifies its purpose:

Pattern	Example
Recommended	`production-web-app`, `staging-backend`, `mobile-app-ios`, `ci-cd-pipeline`
Anti-pattern	`key1`, `test`, `my-key`

Copy and store securely

Click Create.
Copy the full key immediately.
Store it securely - the full key won't be shown again.

The complete API key is only shown once. If you lose it, you'll need to create a new key.

Viewing existing keys

In the API Keys section, you see:

Column	Description
Name	The name you assigned
Type	Publishable or Secret
Prefix	First few characters (for example `pk_live_abc...`)
Created	When the key was created
Last used	Most recent API call using this key

For security, only the key prefix is displayed. The full key cannot be retrieved after creation.

Rotating keys

Key rotation is a security best practice. Rotate keys:

Every 90 days (recommended).
After team member departures.
If you suspect a key was compromised.
When changing environments.

Rotation process

Create the new key

Create a new API key with the same type as the one you're replacing.

Update your applications

Deploy the new key to all applications that use the old key:

// Update environment variable
// Before: CLOUDSIGNAL_SK=sk_live_old123...
// After:  CLOUDSIGNAL_SK=sk_live_new456...

Verify the new key works

Test that your applications work with the new key before revoking the old one.

Revoke the old key

Once confirmed, revoke the old key (see below).

Keep both keys active during the transition period to avoid downtime. Revoke the old key only after confirming the new one works.

Revoking keys

Revoke keys when:

They're no longer needed.
After completing key rotation.
If compromised or leaked.
When decommissioning a service.

To revoke a key

Go to Settings → API Keys.
Find the key to revoke.
Click the Revoke button (trash icon).
Confirm the revocation.

Revocation is immediate and permanent. Any application using the revoked key will immediately lose access. This cannot be undone.

Best practices

Naming convention

Use a consistent naming pattern:

{environment}-{service}-{purpose}

Examples:
  prod-web-app-frontend
  staging-api-backend
  dev-local-testing
  prod-mobile-ios

Environment separation

Create separate keys for each environment:

Environment	Key name	Notes
Development	`dev-local-backend`	For local testing
Staging	`staging-api-server`	For QA and testing
Production	`prod-api-server`	For live traffic

Access control

Practice	Why
Limit who can create keys	Only admins should create secret keys
Document key usage	Track which services use which keys
Audit regularly	Review unused or old keys quarterly

Storage guidelines

Storage method	Recommended for
Environment variables	Most applications
AWS Secrets Manager	AWS deployments
HashiCorp Vault	Enterprise or multi-cloud
Vercel or Netlify secrets	Serverless deployments
GitHub Secrets	CI/CD pipelines

Never store API keys in:

Source code.
Git repositories.
Client-side code (secret keys).
Logs or error messages.

Troubleshooting

"Invalid API Key" error

Check	Resolution
Key type	Using `pk_` where `sk_` is required?
Full key	Keys are long; ensure it wasn't truncated
Revoked?	The key may have been revoked
Environment mismatch	Using a test key in production, or vice versa

"Unauthorized" error

Check	Resolution
Permissions	Publishable keys have limited permissions
Operation	Some operations require secret keys
ACL rules	The key may not have access to the requested resource

Key not showing in dashboard

Keys are only fully visible immediately after creation.
Only the prefix is stored for display.
If you need the full key, create a new one.