API key management best practices

Key format

• Sandbox keys: cg_sk_ followed by 64 hex characters
• Production keys: cg_pk_ followed by 64 hex characters

Storage

Never keep keys in source code, committed configuration or client-side applications. Use environment variables locally, a secrets manager (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) in production, and CI/CD secrets for pipelines. Do not bake keys into container images.

Key limits

Each environment can hold up to 2 active keys. A key that is being rotated stays active for its grace period and counts toward the limit, so revoke an old key before creating a third.

Monitoring

Review Dashboard → Developer → Usage and the audit log (GET /v1/developer/audit-logs). Look for unexpected request spikes, unexpected 401 or 403 errors, and keys you no longer use.

If a key is compromised

1. Rotate or revoke it at once (POST /v1/developer/keys/{keyId}/revoke revokes immediately by default) 2. Create a replacement and update your services 3. Review the audit log and usage for the exposure window 4. Email support@compliancegrid.ai if you suspect data was accessed