Tenant API keys
Auth apps can now let the members of each tenant create API keys for their own CI, scripts and end-to-end tests. Keys are scoped to one tenant and to scopes your app defines, never above their creator's role, always expire, and your backend verifies them with one cached call.
If your customers have been asking for API keys, Auth now issues and verifies them for you. Turn tenant API keys on for an app, list the scopes a key may carry, and a tenant member can create a pctk_live_ key, see it once, rotate it with up to 24 hours of overlap, or revoke it. A key can never do more than the person who created it, it expires after 7 to 365 days, and it stops working when its creator leaves the tenant.
Your backend checks a key with POST /:appSlug/v1/tenant-api-keys/introspect using your Platform API key, caches the answer for up to 30 seconds, and authorises the request with the tenant and scopes it gets back. You can push your key settings from code on boot, or route every key change through your own API so it lands in your own audit trail. In the console, each tenant has an API keys tab where you can see and revoke its keys, and the app's Settings have a switch that suspends every tenant key at once.
Read the concepts and the adoption guide, Let your customers create API keys. The endpoints are in the Auth API reference.