Key lifecycle
Keys are long-lived credentials, so their lifecycle is deliberately simple and observable.
See where keys are active
The key list shows every key you created, with its scope and state. You see where each key is active — which agent, which purpose — so no credential becomes an orphan nobody remembers.
See last used
Every key shows when it was last used. A key that has not been used in months is a candidate for disabling — unused credentials are a liability, and the list makes them visible.
Disable and create a new key
There is no key rotation endpoint
Plainly: there is no per-key rotation endpoint. Rotation is disable the old key, create a new key with the same agent name — two simple steps, no URL to remember, no special API. Don’t go looking for a rotate button; this is the designed workflow.
The flow is:
- Create a new key for the agent (same agent name, current scope).
- Point the agent at the new key.
- Disable the old key — instantly, everywhere it was active.
Because every key is attributed to its agent, the agent name stays continuous across the change — the log keeps reading “agent X did it” before and after.
Multiple keys per agent
Keys are not grouped per agent today
Today, keys are managed individually — multiple keys are not grouped under one agent entry. If you run two keys for one agent, they appear as two keys. Grouping per agent is on the roadmap.
The lifecycle in one line
Create per agent → scope it → watch “last used” → disable when done → replace by creating a new key. See also Identity & delegation for the person/company choice made at creation.