API keys

DialerBee separates an integration from its credentials.

• An API client is one system that talks to DialerBee for you, for example "Salesforce production" or "Nightly BI export". It has a name, its scopes, its own IP list and its own rate limits. Everything it does is audited under its name.
• A credential (a key) belongs to one API client. A client can hold several keys at once. Each key has its own creation date, optional expiry date, last-used time and revoked state.

Give each system its own API client. If one key leaks you can revoke it without breaking any other system, and the audit trail shows which system did what.

The secret is shown once

When a key is created, its secret is shown once. DialerBee stores only a one-way verifier and cannot show it again. If you lose it, create a new key and revoke the old one.

Rotating a key without downtime

1. Create a second key for the same API client.
2. Deploy the new key to your system. Both keys work during the change-over.
3. Check that your traffic uses the new key (the console shows each key's last use).
4. Revoke the old key. It stops working within 15 seconds.

Because keys belong to the API client, a rotation changes nothing else: the scopes, the IP list, the audit history and the idempotency keys of that client all carry on.

Expiry

A key can have an expiry date. Your account admin can set a maximum lifetime for new keys. An expired key answers 401 api_key_expired; add a new key to the same API client and switch to it before the old one expires.

Scopes

A new API client has no scopes. With no scopes, a key can call only GET /v1/me. Grant each client only the scopes it needs.