API key management

Lifecycle#

• Generate from the dashboard. Keys carry an mcpb_ prefix so they are recognizable in logs and support tickets.
• Rotate in one click. The old key stays valid for a 7-day grace period, so integrations do not break the moment you rotate.
• Revoke immediately when a key leaks.

Storage#

Only the SHA-256 hash is stored. The full key is shown once at creation and never again. A database dump does not hand an attacker working credentials.

Changing the grace period#

The rotation grace period is one of the marked customization points in api-key.ts. Shorten it if your integrations redeploy quickly, lengthen it if your customers move slowly. See configuration.

Related: OAuth 2.1, security decisions.