API Keys and Rotation

Each project has its own API key. A key works for that project only, so rotating or revoking it never affects your other projects.

Example key format:

nlx_proj_xxxxxxxxxxxxxxxxxxxx

Where users can access keys

• Settings → API Keys (across projects)
• Project detail → SDK Key (single project context)

Why keys are per project

• Access is isolated by project
• You can rotate one project's key without touching the others
• A leaked key exposes one project, not the company

Handling keys

• Store keys in a secret manager
• Inject keys via environment variables at runtime
• Show keys only to the people who deploy the service
• Rotate on a regular cadence and immediately on exposure

Rotation behavior

When rotating a key:

• The old key stops working immediately
• The new key is shown once, so copy it before you close the dialog
• Services still using the old key fail authentication

Plan the rollout so you do not drop data: update your secrets, deploy, then finalize the rotation in the console.

Rotation steps

1. Update runtime secrets with the new key
2. Deploy all services that use the key
3. Validate ingestion and request behavior
4. Finalize rotation in Nolax