API keys Web app

Key generation and revocation with transparent access scope.

6 checks · 2 content groups

Checklist contents

Review progress

Information and structure

Compare information and presentation in context of use.

Identify each keyDisplays name, creation date, last use and status.The contextual name helps determine which key to revoke without seeing the secret value.Example The “Report integration — read only” key is separated from the test key.Choose permissions when creatingExplain each scope and default to the appropriate permission level for the task.Use the minimum permissions appropriate to the task; Test environments and real environments need to be distinguished before generating keys.Explain one-time key viewingAllow copying when creating and clearly state how to handle it if the user does not save it.If the key appears only once, notify in advance and have it copied with feedback; close the prompted dialog box without saving the key.

Actions and status

Try the operation, change the status and continue working.

Do not make the key publicHide values in the list and avoid displaying them in examples, logs, or URLs.Do not include key values in error snapshots, browser logs, or links; short identifying information sufficient to differentiate the keys.State the consequences before revocationIndicates that the connection in question can be stopped and confirms the correct key.Indicates last use and potentially affected system prior to recall; It is recommended to replace the lock before removing the old lock.Set the user manual closest to youLink to authentication documentation, safety examples, and how to check permission errors.For example, calling an API must use a secure value holder, not embed a real key; The document should state the validation error code and limit.

Progress is saved automatically in this browser.

GUIDANCE

How to review

Identify each key

The contextual name helps determine which key to revoke without seeing the secret value.

EXAMPLES

Usage examples

Identify each key

The “Report integration — read only” key is separated from the test key.

API keys Web app

Information and structure

Actions and status

How to review

Identify each key

Usage examples

Identify each key

Find a checklist

No checklists found