Securely generate, rotate, and manage API keys for your team.
# Managing API Keys
API Keys allow external applications to authenticate with LaunchSuite on behalf of your team.
## Security Architecture
We prioritize security in how we handle API keys:
1. **Hashing**: Keys are hashed using SHA-256 before storage (`keyHash` column). We never store the raw key.
2. **Prefixes**: Keys are prefixed (e.g., `sk_live_...`) to make them identifiable and scannable by secret detection tools.
3. **Scopes**: Keys can be scoped to specific actions (e.g., `read:users`, `write:billing`).
## Generating a Key
1. Navigate to **Settings > API Keys**.
2. Click **Create New Key**.
3. Give it a descriptive name (e.g., "CI/CD Pipeline").
4. (Optional) Select scopes to limit its permissions.
5. **Copy the key**. It will not be shown again.
## Revoking a Key
If a key is compromised or no longer needed:
1. Find the key in the list.
2. Click **Revoke**.
3. The key will immediately stop working.
## Best Practices
- **Rotation**: Rotate keys periodically (e.g., every 90 days).
- **Environment Variables**: Store keys in `.env` files, never in code.
- **Least Privilege**: Grant only the scopes necessary for the task.