Skip to main content
On this page

Key lifecycle

API keys are persistent credentials that grant secure programmatic access to your etg24 tenant. To minimize security liabilities and maintain organizational clarity, their lifecycle is transparent and observable.

Monitoring key usage

The API management dashboard in the etg24 app displays every active credential with its assigned scopes, actor binding, and status:

  • Assigned agent name: Ensures every key is clearly associated with a known integration or workflow, preventing orphaned credentials.
  • Last used timestamp: Displays the exact date and time the key was last authenticated. Keys with no activity for extended periods should be reviewed and decommissioned.

Zero-downtime key rotation

Rotation workflow by design

etg24 deliberately does not provide an automated “key rollover” endpoint that silently replaces secrets. Instead, key rotation follows an explicit three-step blue/green pattern: generate new credential → update client configuration → revoke old credential. This guarantees zero downtime and prevents accidental disconnections.

To rotate an API key without service interruption:

  1. Generate a replacement key: In the etg24 app, create a new API key with the identical agent name and appropriate scopes.
  2. Update the client configuration: Deploy the new key into your environment variables or secret manager (e.g. ETG24_API_KEY).
  3. Revoke the deprecated key: In the etg24 portal, disable the old key. Revocation takes effect immediately across all edge proxies.

Because keys carry a persistent agent name, Audit trail & change attribution remains continuous across the rotation — logs consistently identify the responsible agent before and after the credential rollover.

Immediate key revocation

If an API key is accidentally exposed or an integration exhibits aberrant behavior:

  1. Open the API keys view in the portal settings.
  2. Click Disable next to the affected key.
  3. All subsequent requests using that key are rejected immediately with 401 Unauthorized.

For detailed information on configuring user-bound vs. company-bound keys, see Identity & delegation.