Credential management
Create, inspect, rotate and revoke application credentials without exposing secrets.
Issue for a defined responsibility
Authorized institutions create credentials with POST /v1/credentials. Use a meaningful label and the credential scope supplied to your institution. Read endpoints return metadata; secrets are shown only on creation or rotation. Store the secret immediately.
Coordinate rotation
POST /v1/credentials/{public_id}/rotate replaces the active secret immediately. There is no overlap window. Coordinate application cutover and monitor authentication failures; do not assume the old secret remains valid.
Revoke and investigate
DELETE /v1/credentials/{public_id} revokes a credential. Permitted Console operators can use the credential-revocation workflow. Retain audit references and inspect affected application queues without logging secrets.