Issue API keys that you can scope, rotate, and revoke

Give your services, your customers, and your partners' integrations API tokens that Auth issues, rotates, and revokes for you. Every token has its own scopes, an optional IP allowlist, and a request count, so you can limit and measure what each caller does.

Read documentationView pricing

Give every customer and service its own API key

Create a token for each customer of your SaaS product, each backend service, and each third-party integration, and scope each token to the endpoints that its caller uses. Auth counts the requests that callers send with each token, so you can tell which callers depend on a token before you rotate or revoke it.

How Auth issues, limits, and retires machine tokens

Token generation

Auth generates each token secret from a cryptographically secure random value and gives the token a unique identifier and an optional expiry date. Auth stores only a hash of the secret, so you see the full secret only in the response to the call that creates the token.

Scoped permissions

Give each token only the permissions that its caller needs, such as read access to invoices for a billing service or read access to analytics for a reporting job.

Zero-downtime rotation

During a rotation, Auth keeps the old token valid alongside the new one for an overlap period that you set. Update each service with the new secret within that period, then revoke the old token.

IP allowlisting

Limit a token to specific IP addresses or CIDR ranges. Auth rejects a request from any other address before it checks the token's permissions.

Usage tracking

Auth records every token's request count and the time of its last use, so you can find idle tokens to revoke and see which integrations send the most requests.

Labels and metadata

Label each token with its environment, its service name, or any custom metadata, then filter the token list by production, staging, or integration type.

Expiration policies

Auth invalidates a token on the expiry date that you set and sends a webhook before that date, which your rotation workflow can use as its trigger.

Rate limiting per token

Each token can have its own request limit, separate from the limits on your service as a whole, so a partner's token can allow a different number of requests per minute than the tokens of your internal services.

< 5ms
Token validation

Authentication check latency

SHA-256
Token hashing

Hash that Auth stores in place of each secret

Custom
Tokens per project

Token count scales with your plan

Build faster with solutions designed for real-world needs

Check the API key on every request that a customer sends to your API

Each Lanternfish Maps customer sends their account ID in the X-Lanternfish-Account header and their API key as a bearer token. The requireCustomerKey function in the sample passes both to verifyCredential, which checks the key against that account and adds one to the usage count of the key when the key is valid.

Impact

Since the SDK places the account ID in the URL path of its request to Auth, the function answers with 401 when that ID is missing or contains a character other than a letter, a digit, an underscore, or a hyphen. The function also answers with 401 whenever Auth rejects the key, for example because the secret is wrong or because the key is revoked or expired. When a key goes over the rate limit that you set on it, Auth answers with HTTP 429, so the function returns 429 to the customer.

Prompt for a coding agent: Check the API key on every customer request, and return 429 when a key reaches its limit.

Conjoin IDE

Select a file to view its contents

Label an API key with its environment and the service that uses it

updateApiKey changes the settings of an active key, including its label, its environment, its token metadata, its IP allowlist, and its rate limit. To pick the key, pass the credential_id that listCredentials returns for it.

Impact

The sample labels one Quillmoor Logistics key as quillmoor-route-planner in the production environment and records the owning team and the service in its token metadata. The script then prints the credential ID and the update time from the response.

Prompt for a coding agent: Label this key as the production route planner, and record its team and service.

Conjoin IDE

Select a file to view its contents

Find keys past your rotation window and remove them

Filter the credentials on an account down to its API keys, then remove each key whose creation time falls before a cutoff that you choose.

Impact

The sample removes each API key on the Northrock account that is more than 90 days old. Because it checks that the kind of each credential is api_key first, the account keeps its passwords and MFA factors.

Prompt for a coding agent: Remove every API key on this account that is more than 90 days old.

Conjoin IDE

Select a file to view its contents

Limit how many requests each partner key can make per minute

Set rate_limit on each API key that a partner holds. Auth counts the verifyCredential calls that carry the correct secret for a key in a fixed window of window_seconds and answers with HTTP 429 once the count goes over max_requests.

Impact

The sample lists the credentials on the Kestrel Ridge account and keeps the ones whose kind is api_key. It sets a limit of 60 checks every 60 seconds on each of those keys, although it skips a key whenever updateApiKey throws a ConjoinError with status 404, which Auth returns for a key that is no longer active.

Prompt for a coding agent: Limit each partner API key to 60 checks per minute.

Conjoin IDE

Select a file to view its contents

Build your next app on Conjoin

Conjoin will open with a free Build tier, while the pricing page already lists the launch prices for Pro and Business. If you tell us what you're building, we'll talk you through early access.

See pricingGet early access