API keys
Every project has two kinds of key.
Key | Prefix | Where it may live | Bypasses policies |
|---|---|---|---|
Publishable |
| Browsers, mobile apps | No |
Secret |
| Servers, CI | Yes |
A leaked secret key can read and write every row. Rotate it from Project settings → API and redeploy any server that used it.
Rotating keys
Rotation creates a new key and keeps the old one valid for 24 hours, so you can roll servers without downtime.
basalt keys rotate --type secret --grace 24hUpdated
Was this page helpful?