Manage API Keys
Create, rotate, and revoke API keys with role-based access, wallet bindings, and zero-downtime rotation.
Create, rotate, and revoke the API keys that authenticate SDP API requests. Each key belongs to a project, inherits its environment, and carries a role plus optional fine-grained controls — see Authentication for how those layers are enforced.
The full secret is returned exactly once — at creation and at rotation. SDP stores only a salted hash and a display prefix; a lost key cannot be recovered, only rotated or replaced. Every key tracks lastUsedAt so you can identify stale credentials before revoking them.
Key format
| Environment | Prefix | Solana network |
|---|---|---|
| Sandbox | sk_test_ | devnet |
| Production | sk_live_ | mainnet-beta |
Roles
| Role | Description |
|---|---|
api_admin | Full access including custody and platform operations |
api_developer | Read/write access, excludes custody actions |
api_readonly | Read-only access to all resources |
A key can also carry explicit permissions that override the role's defaults. A key can only be granted permissions its creator holds.
Create a key
-
Navigate to API keys in the sidebar. You start with an empty list.
-
Click New API key in the top right, then fill in the key details:
- Name — a descriptive label (e.g., "CI deploy key")
- Role — Admin, Developer, or Read only
- Wallet access — All wallets or Selected wallets
- Expiration (optional) — date/time picker
-
Click Continue, review the summary, and click Create key.
-
Click Copy on the API key generated modal and save the key — it will not be shown again.
-
Dismiss the modal. The key now appears in the table with its prefix, role, environment, and status.
Rotate a key
Rotation replaces the secret without an availability gap: the new key is a fresh record that clones the old key's role, permissions, IP allowlist, wallet bindings, and policy profiles, while the old key keeps working until its grace deadline. During the grace period both keys are valid; after it, the old key fails with EXPIRED_API_KEY.
-
In the API keys table, open the Actions dropdown next to the key and click Rotate key (24h grace). The dashboard always uses a 24-hour grace period — use the API for a custom value (0–168h).
-
Copy the new key value from the generated key modal — it is shown once.
Revoke a key
Open the Actions dropdown next to the key and click Delete key. The key stops working immediately and cannot be restored.