Skip to content

docs: document revoking the previous root key on regeneration #5050

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mintlify wants to merge 2 commits into
base: main
Choose a base branch
from
Open

docs: document revoking the previous root key on regeneration #5050

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1717d60
docs: document revoking the previous root key on regeneration
mintlify[bot] Oct 22, 2026
89b899a
docs: cover masked hidden root keys and revoking keys in their grace …
mintlify[bot] Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions docs/apikeys.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,15 @@ Revoking a key takes effect immediately and cannot be reversed. Requests using t

Removing a team member does not revoke keys they created. Review and revoke their keys separately when their access changes.

### Regenerate the root key

The key marked **Root** on the API keys page has a **Regenerate…** action in its row menu. Regenerating issues a new root key for the environment, and you choose what happens to the previous one:

- **Keep the previous key working for 24 hours** (the default): roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours.
- **Revoke the previous key immediately**: choose this if the key may have leaked. The previous key stops working now, along with any older root key still in its 24-hour window. Deployments and services still using them fail until you update them with the new key.

@devin-ai-integration devin-ai-integration Bot Oct 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟨 Older leaked root keys stay valid

When an older root key remains in its 24-hour window, selecting revokeImmediately does not revoke it. regenerateApiKey leaves existing grace records intact, so a leaked older key continues authenticating.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


The page always lists the root key. If the root key is hidden, it appears masked to its last 4 characters. You can regenerate a hidden root key, but you can't reveal or copy it.

@devin-ai-integration devin-ai-integration Bot Oct 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Hidden root key instructions conflict with dashboard

After visibility is disabled, rootApiKey is null, so the dashboard shows no masked root row. regenerateApiKey also rejects hidden keys, leaving no documented regeneration path.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


## Create public access tokens

API keys can be used to create scoped [Public Access Tokens](/realtime/auth) using `auth.createPublicToken()`.
Expand Down
Loading