Help Screens Developer credentials
API key detail KEY-04
Edit, rotate or revoke a key.
| Who can use it | api_keys.manage or app owner |
|---|---|
| Where it is | /dev/keys/:keyId · link: https://hub.substratalapps.com/dev/keys/:keyId or substratal://dev/keys/:keyId |
| Available on | Web (PWA), iOS / iPadOS, Android, Windows, Linux (GNOME), macOS |
| Phase | MVP |
What you can do here
- Save
- Rotate — 200 → KEY-03
- Revoke — 204 → row shows Revoked
Related guides
- API keys — Create keys for servers and agents, store the secret, rotate without downtime, and revoke.
- Rotate an API key without downtime — Replace a server's key with no failed requests.
On your platform
| App | Status | How it's built |
|---|---|---|
| Web (PWA) | — | Detail pane with header, tablist, toolbar; full page < 768 px |
| iOS / iPadOS | — | Pushed view; segmented Picker; toolbar actions |
| Android | Planned | Detail pane / pushed screen; PrimaryTabRow; top-bar actions |
| Windows | — | Detail pane / drill-in page; SelectorBar tabs; CommandBar actions |
| Linux (GNOME) | — | Content pane; AdwViewSwitcher; header-bar actions |
| macOS | — | Detail column; tabs as segmented Picker in toolbar principal |
Status is reported by each app's repository; — means that app doesn't report it yet.
For developers: API calls
| Method | Path | What it does |
|---|---|---|
| GET | /audit-events | Query the audit log (hot window only) |
| GET | /api-keys/{id} | Fetch one key (never the secret) |
| PATCH | /api-keys/{id} | Change name, permissions, or restrict_destructive |
| DELETE | /api-keys/{id} | Revoke permanently |
| POST | /api-keys/{id}/rotate | Issue a new secret, invalidating the old one immediately (no overlap) |
Every call sends Substratal-Version: 1. Paths are at the host root, with no /v1.