Service-to-service credentials, scoped to what each caller may reach.

Partner API access usually starts as a shared secret in an environment variable and grows into a spreadsheet. Nobody is certain which key belongs to which customer, keys are never rotated because rotation means a coordinated redeploy, and revoking access means grepping config across services.

The moment a partner integration breaks, the first question — which client was that, and what were they allowed to call? — takes an afternoon to answer.

Each calling service gets its own client ID and secret, bound to a single application environment. Staging credentials cannot reach production, and a leaked key is scoped to exactly one service in one environment rather than to everything.

Secrets are stored as HMAC-SHA256 digests with a shared pepper and compared in constant time. The plaintext secret is shown once, at creation, and never again — not in the portal, and not in logs.

Rotating a secret issues a new one while the previous secret keeps working until an expiry you choose. The caller picks up the new value on their own schedule and the old one stops working on yours.

This is the difference between rotation being a routine hygiene task and being a change-managed event nobody volunteers for. If rotation requires both sides to deploy simultaneously, it does not happen.

Endpoints are bundled into packages and granted to client organizations. Adding or removing a consumer's access is a change in one place — no application code, no secrets redistributed across services, and no deploy.

Clients onboard themselves through an invite, so issuing access to a new partner does not require an engineer on either side.

Each authorization — allowed or denied — is written down along with the calling service, the endpoint, and the endpoint version requested. That record is what makes the rest of the platform work: it is how “who is still on v1” becomes answerable, and how a failing integration can be attributed to a specific consumer rather than to “someone”.

Per-plan usage limits are enforced at the edge and fail closed: an organization with no active subscription resolves to the free plan's limits rather than to unlimited.