Skip to content

Learn · Guides

Rotate an API key

Replace a live key with no gap in service.

Checked against the product on · written for people writing code

Two key modes exist. A sandbox key runs against test data and bills nothing. A live key runs against your real work areas. Both authenticate the same way, with a bearer token.

console.dmzagent.com/keys

Automate

Developer tools

1KeysSDKWebhooks
2
KeyModeScopesCreatedLast used
ck_live_…4f2aLiveevents:write, cb:read2026-06-0212 seconds ago
ck_test_…9b17Sandboxevents:write, cb:read2026-06-024 hours ago
3RotateRevokeNew key
Figure. The developer tools screen, with both key modes and their scopes. The developer tools screen: API keys with their mode and scopes, and the copyable install snippet.

Rotate with no downtime

  1. Open Developer tools and stay on the Keys tab.1

  2. Read the scopes on the key you are replacing.2

    The new key needs the same scopes.

  3. Select New key and copy the value at once.3

    The full value appears one time.

  4. Deploy the new key to your systems and confirm traffic on it.

    The Last used column moves within seconds of the first call.

  5. Select Revoke on the old key.

    Revocation takes effect on the next request. Both the creation and the revocation are written to the audit log.

Watch out. A key value appears once, at creation. A lost key is replaced by a new one.

From code

curl -X POST 'https://api.dmzagent.com/v1/api-keys' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"name": "ingest", "livemode": false, "scopes": ["events:write", "cb:read"]}'

The value appears once, in this response.

What each scope grants.
ScopeGrants
events:writeSend events about a watched thing.
cb:readCheck a standing before a sensitive action.
reviews:writeAcknowledge a dispatched fix.
records:readRead the logbook and build an evidence pack.
library:readBrowse the rule pack library and read a manifest.
Ask the assistant to wire this in →Open your organization