API Key Security

Overview

Secret API keys (sk_live_...) grant full administrative access to your Asiyst organization. Protecting these credentials is vital to maintaining data integrity.

Principle of Least Privilege

When creating API keys in Project Settings > API Keys:

1. Scoped Permissions: Create keys scoped strictly to required resources (e.g. knowledge:read, conversations:export, telemetry:write) rather than using full-admin keys everywhere.

1. Environment Isolation: Maintain separate keys for Local Development, Staging, and Production CI/CD pipelines.

1. Dedicated Service Accounts: Issue separate keys for external integrations (e.g. Zapier, Make, Slack Bots).

Key Rotation Playbook (Zero Downtime)

Rotate production API keys every 90 days following this sequence:

1. In the dashboard, click Generate Secondary API Key.

1. Deploy the secondary key to your backend servers or GitHub Actions secrets.

1. Verify that server requests are succeeding with the new key.

1. Return to the dashboard and click Revoke Primary Key.

Immediate Revocation Procedure

If a secret key is accidentally committed to a public GitHub repository:

# Revoke instantly via CLI
asiyst keys revoke key_9f8a2b3c4d --force
# Or via REST API
curl -X DELETE "https://asiyst.com/api/v1/api-keys/key_9f8a2b3c4d" \
  -H "Authorization: Bearer $ASIYST_BACKUP_TOKEN"

Revocation takes effect across all edge gateways in < 500 milliseconds.

Automated Secret Leak Detection

Asiyst partners with GitHub Secret Scanning and GitGuardian to automatically detect and instantly deactivate keys pushed to public repositories.