Key lifecycle

Every Locus Pro key goes through the same life: you create it, store it, use it, rotate it, and eventually revoke it. This page is for workspace owners and admins who manage keys.

​

How it works

Locus shows a key’s value once, when you create or rotate it, and stores only a hash. Rotation swaps the value but keeps the key’s settings. Revocation ends the key for good.

​

Create and store a key

A key can’t create other secret keys. Review key changes under Audit log on Connect → API keys.

​

Lifetime, rotation, and revocation

Use the rotation overlap to deploy the new value before the old one stops working. Revoking is immediate and permanent for every kind of key, so create a new key if you need access again. Revoke end-user tokens one at a time, or all of a customer’s tokens by retiring the customer. Revoke connected apps under Connected apps.

​

Automate agent keys

A server key with both credentials:manage and credits:move can create or rotate agent keys, or move one to another tool set, without human verification. Revoking needs only credentials:manage. In the dashboard, the same actions need an owner or admin with recent verification. See Agent keys for what each agent key controls.

​

Next steps