API Keys, Scopes & Quotas: Sharp Tools Need Labels

An API key is a production tool. Treating it like a password taped under a keyboard is how integrations become incident reports. ReVend OS gives API keys their own management surface because sharp tools deserve labels. /settings/api is the hub — one card each for keys, webhooks, documentation and usage — and /settings/api/keys is where the keys live.

Scopes

Keys use scopes: read, write and admin. Endpoints declare the required scope. A reporting integration should not receive admin power just because it was easier to click the biggest checkbox. A key can also carry an expiry date, so a key created for a migration weekend stops working on Monday without anyone remembering to revoke it.

Limits

Responses include rate-limit and monthly-quota headers. The per-minute default follows the package — 30 for a sandbox organization, 60 on starter, 120 on professional, 300 on enterprise — and can be overridden per key when one integration legitimately talks more than the others. Minute limits prevent noisy loops from becoming a platform weather system; monthly quotas connect usage to the tenant’s package. Usage appears under /settings/api/usage so integration owners can see what their systems are actually doing.

IP allowlists and last-used data

Keys can carry IP allowlists, and a call from outside the list is refused and logged as an IP denial. Successful use records last-used time, IP and user agent. When something starts calling from a new place, admins have facts instead of a room full of guesses.

Bidder binding

A key that places bids has to say whose bids they are. Binding a key to a bidder principal is available only for verified, premium, non-blocklisted bidder companies, so a key cannot pretend to represent a buyer it is not allowed to represent. The auction rules that apply to the human apply to the script.

Rotation

Key create and rotate show the plaintext token once. Rotation issues a new token and keeps the old one valid for a seven-day overlap, long enough to deploy the new key and remove the old one from the external system. After that, the secret is a hash and a memory. Key security actions — create, rotate, revoke — write audit events you can review from the same page. This is inconvenient in exactly the way security should be.