Repository navigation
docs: document revoking the previous root key on regeneration - #5050
mintlify[bot] wants to merge 2 commits into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - **Keep the previous key working for 24 hours** (the default): roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours. | ||
| - **Revoke the previous key immediately**: choose this if the key may have leaked. The previous key stops working now, along with any older root key still in its 24-hour window. Deployments and services still using them fail until you update them with the new key. | ||
|
|
||
| The page always lists the root key. If the root key is hidden, it appears masked to its last 4 characters. You can regenerate a hidden root key, but you can't reveal or copy it. |
There was a problem hiding this comment.
🔍 Hidden root key instructions conflict with dashboard
After visibility is disabled, rootApiKey is null, so the dashboard shows no masked root row. regenerateApiKey also rejects hidden keys, leaving no documented regeneration path.
Was this helpful? React with 👍 or 👎 to provide feedback.
| The key marked **Root** on the API keys page has a **Regenerate…** action in its row menu. Regenerating issues a new root key for the environment, and you choose what happens to the previous one: | ||
|
|
||
| - **Keep the previous key working for 24 hours** (the default): roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours. | ||
| - **Revoke the previous key immediately**: choose this if the key may have leaked. The previous key stops working now, along with any older root key still in its 24-hour window. Deployments and services still using them fail until you update them with the new key. |
There was a problem hiding this comment.
🟨 Older leaked root keys stay valid
When an older root key remains in its 24-hour window, selecting revokeImmediately does not revoke it. regenerateApiKey leaves existing grace records intact, so a leaked older key continues authenticating.
Was this helpful? React with 👍 or 👎 to provide feedback.
Summary
Adds a short "Regenerate the root key" section to the API keys page, covering both choices for the previous key: keep it working for 24 hours, or revoke it immediately if it may have leaked.
Revoking immediately also stops any older root key still in its 24-hour window, and a hidden root key now appears masked to its last 4 characters and can be regenerated but not revealed or copied.
Regenerating the root key used to always keep the old key valid for 24 hours, and the docs did not describe regeneration at all.
Based on feat(webapp): option to revoke the old root key immediately, which added the revoke-immediately option to the regenerate dialog, and feat(webapp): show hidden root API keys masked and allow regenerating them, which lists hidden root keys masked and extends immediate revocation to older keys.
Docs only. Mark ready for review to merge.