A key is how a call is authenticated and how spend is attributed. You can hold ten at once.
Minting#
- Ten active keys per account. The limit is enforced by the database, not by a check that can be forgotten.
- Shown once. We store only an argon2id hash with a pepper, so we cannot show it again and cannot recover it.
- Name them. A name is the only way to tell ten keys apart later, and it appears in the spend breakdown.
The 24-hour cap#
Each key is capped or uncapped. A cap is a rolling 24-hour spend ceiling for that key — not a calendar day, not a monthly budget.
cap = 5000000 micro ($5.00)
09:00 spend $4.80 -> allowed, $0.20 of headroom left
09:01 spend $0.50 -> 402 Budget_Exhausted, nothing charged
next day 09:01 -> the 09:00 spend ages out, headroom returnsAn uncapped key is bounded only by the wallet balance. That is a legitimate choice for a trusted workload, and it is why pre-funding matters: the balance is the ceiling that always applies.
Revocation is immediate#
Revoking takes effect on the next call, not eventually. There is no cache to wait out and no propagation delay to reason about.
Rotation has an overlap window#
Rotating issues a new key while the old one keeps working for a grace period, so you can redeploy without refusing traffic. Expiry is enforced when the key is read, so a missed cleanup job cannot silently extend a credential past its window.
What a key cannot do#
- It cannot change your wallet balance, add funds or move money.
- It cannot read or write another account's anything.
- It cannot raise its own cap. Caps are changed from your account, with a session, not with the key.
- It is never forwarded to a creator.