Partner APIs

A few high-value integrations, scoped keys per partner, a receipt for every revocation, and an audit log you can hand to their security team.

A partner API has few callers and a security questionnaire per caller. The questions are about control: who can do what, how fast can access be removed, and can you prove it.

Scopes per partner

Mint each partner's key with exactly the scopes their integration needs and require them per route. A partner without write:payments gets a 403 naming the missing scope, and the route that spends money sets onUnavailable: 'closed' so an unknown key is never admitted unverified there.

const mw = keyring({
  resources: { orders: { live: liveOrders, test: testOrders } },
  routes: {
    'GET /healthz': { skip: true },
    'POST /v1/payments': {
      onUnavailable: 'closed',
      scopes: ['write:payments'],
    },
    '/v1/internal/*': { onUnavailable: 'stale-then-closed' },
  },
  onError: (error) => console.error('keyring', error),
});

Rotation with a window

A partner cannot restart their fleet on your schedule. Rotation gives the old key an overlap of up to 7 days during which both work, and the partner's own engineer can do it from the embeddable component in your portal.

Revocation with a receipt

POST /v1/keys/:id/revoke?wait=true holds the response until every node that polls the project has acknowledged the revoking policy version, and returns propagation.complete with the count of nodes that did. That is the answer to "how fast can you cut a partner off": within one poll, 5 seconds, and here is the receipt.

The audit log

Every mutation on the workspace is a row written in the same transaction as the change, chained by hash to the previous row, with the person or secret key that made it. The dashboard's Activity page verifies the chain in front of you and says what the verification does and does not catch. GET /v1/audit_logs returns the same rows for your own tooling.

Secrets your partner leaks

If a partner pastes a live key into a public repository, the control plane's secret-scanning webhook quarantines it, pulling its expiry in to one hour rather than killing it on the spot, and mails the workspace owners. The partner registration with GitHub that would deliver those reports is not yet done.

Keys scanned into the wrong logs

@keyring/sdk ships redact, redactString and pino, winston and bunyan serializers that replace anything shaped like a Keyring key with [redacted], so a partner's key cannot end up in your log aggregator.