API keys
Creating, scoping, rotating and revoking the keys that authenticate API requests.
Creating a key
Keys are issued from your account. A key is displayed exactly once, at creation, and stored only as a hash — there is no screen that will show it to you again, and support cannot recover it. If it is lost, rotate it.
Give each key a name that says where it runs — ci, laptop, staging-worker. That name is the only thing you will have to reason with when a key needs revoking in a hurry.
Storing it
The CLI does not need one of these keys: kx login uses a browser flow and stores its credential in your OS keychain. API keys are for programmatic callers.
Rotating and revoking
Rotation is create-then-revoke, in that order: issue the replacement, deploy it, confirm traffic has moved, then revoke the old key. Revoking first means downtime for however long the deploy takes.
Revocation takes effect immediately and cannot be undone. In-flight requests carrying the revoked key fail; nothing already billed is refunded or reversed.