> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create, rotate, and revoke the credentials that authenticate requests to the Living Security Public API.

API keys authenticate requests to the `/v1` Public API. Every key belongs to
a [service account](/developers/developer-hub/service-accounts) and is
created from that account's detail page in the
[Developer Hub](/developers/developer-hub/overview).

Use a scoped API key for a private backend integration when securely storing
and rotating a secret meets your requirements. No OAuth client or token
exchange is needed. See [Authentication](/developers/v1/authentication) if
your organization requires short-lived OAuth access tokens instead.

## Anatomy of a key

* **Identifier** — starts with `ak_`. Safe to reference in tickets, logs,
  and configuration; it grants nothing by itself.
* **Secret** — starts with `lsk_live_`. This is the credential your
  integration presents. It is shown **once**, at creation or rotation, and
  cannot be retrieved later. The key list shows only the last four
  characters (for example `lsk_live_…xQc4`) so you can match a row to the
  credential a caller holds.
* **Permissions** — a subset of the owning service account's permissions,
  chosen at creation. A key can never do more than its account allows.
* **Expiration** — mandatory. Every key has an expiry date.

<Warning>
  Store secrets in a secret manager the moment they are shown. Never commit
  them to version control, embed them in client-side code, or share them in
  chat. Anyone holding the secret can act with the key's permissions.
</Warning>

## Create a key

On the service account's detail page, create a key by walking four steps:
name it, pick the permissions this specific key needs, choose an expiration
— 30, 90, or 365 days, or a custom period up to a year — and review. The
secret is displayed on completion, once.

Scope each key to the narrowest permission set its caller needs, even when
the account allows more. If a key leaks, its permissions are the blast
radius.

## Rotate without downtime

Rotation issues a new secret and starts an overlap window — 1 hour,
24 hours, or 7 days — during which the **old secret keeps working**. That
lets you roll the new secret through your deployments at your own pace:

<Steps>
  <Step title="Rotate the key">
    Choose an overlap window that covers your slowest deployment path. The new
    secret is shown once — store it immediately.
  </Step>

  <Step title="Update your integrations">
    Replace the old secret everywhere it is configured. The key's status shows
    as in-overlap until the window ends.
  </Step>

  <Step title="Verify before the window closes">
    Use the [request logs](/developers/developer-hub/request-logs) to confirm
    traffic has moved to the new secret. When the overlap ends, the old secret
    stops authenticating.
  </Step>
</Steps>

Rotate ahead of expiry, too: keys approaching their expiration date are
flagged as **Expiring soon** in the key list. An expired key stops authenticating —
requests made with it return a `401` with code
[`credential_expired`](/developers/v1/errors/credential_expired).

## Expiry notifications

When expiry notifications are enabled for your organization, Living Security emails and notifies admins before service-account API keys cross configured thresholds (for example 30, 14, 7, and 1 days before expiry, plus when a key expires).

Configure organization defaults from **Settings** → **Integrations & Developers** → **Developer Hub** → **Expiry notifications**:

| Setting | What it controls |
| - | - |
| **Recipients** | Which admins receive notices. When none are selected, every admin who can manage service accounts is notified. |
| **Channels** | Email, in-app, Slack DM, and/or Microsoft Teams DM (when those integrations are connected). |
| **Days before expiry** | One or more day thresholds that trigger a notice before the key expires. |

On a service account's detail page, open the **Expiry notifications** tab to override recipients for that account only. Clearing the override returns the account to the organization list.

## Revoke immediately

Revocation takes effect immediately and is permanent — there is no overlap
window and no undo. Revoke a key the moment you suspect its secret has been
exposed; rotate instead when you are replacing a healthy credential.

Requests made with a revoked key return a `401` with code
[`credential_revoked`](/developers/v1/errors/credential_revoked). If you
need to stop every key an integration holds at once, disable its service
account instead.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.