API keys
How to provision, scope, and revoke keys.
~ 1 min read
Cipher distinguishes two key types.
Sandbox vs production
| Key type | Prefix | Rate limit | Auto-rotate |
|---|---|---|---|
| Sandbox | sk_test_ | 100 req/min | Never |
| Production | sk_live_ | Plan-dependent | Every 30 days |
Scoping
Production keys can be scoped to specific operations:
cipher keys create --scope encrypt:* --scope decrypt:tenant-alphaRestrictive scopes ship with their own audit channel — useful for letting a CI runner encrypt without ever decrypting.
Last updated
Edit this page