API keys

Team → API keys (Admins) mints keys for CI and scripts. Each key carries a role and is held to the same permissions as a person with that role.

• Expiry. Choose 30 days, 90 days, 1 year (the default) or Never when you create a key. Never is discouraged: a key that never expires stays valid if it leaks.
• Seeing the key once. After creating it, the key is shown once, masked (proberun_••••••••…abcd). Press Copy key (it says “Copied”, and screen readers hear “Key copied”), Show key to read it, or Download .env for a PROBE_API_KEY=… line. The browser warns you if you leave the page before pressing I’ve copied it. The key cannot be shown again after that.
• Telling keys apart. The list shows each key’s last 4 characters as proberun_…abcd and who created it. Keys created before this format show “older key” and keep working.
• Roll replaces a key with a new one of the same name, role and lifetime. The old key stops working immediately, so update every place that uses it. Revoke stops a key for good. Both ask you to confirm first.
• If a key leaks. Roll or revoke it. ProbeRun keys start with proberun_ and end in a checksum so that secret scanners can recognise them; automatic detection by GitHub is not live yet.
• After a roll, Created by still names the key’s original creator; who rolled it is in the audit log.