API Keys

API keys are Plane B credentials and must stay server-side.

Create and rotate

Use the backoffice or the Plane B API:

• GET /internal/api-keys
• POST /internal/api-keys
• PATCH /internal/api-keys/{id}
• DELETE /internal/api-keys/{id}

Handling rules

• Store keys in Vault or a dedicated secret manager.
• Never put keys in mobile apps.
• Never commit keys to Git.
• Scope keys by environment.
• Rotate keys when an operator leaves, a CI system changes, or logs suggest exposure.

Public documentation boundary

The public API reference is read-only. It does not execute requests or accept credentials. Never enter institution API keys or HMAC secrets into a browser.