Guides

API Keys

One key authenticates every publish call your Application makes. Keys are scoped to a single Application — a key for one Application can never publish events into another.

Shown once, stored as a hash

The plaintext key (whk_...) is only ever returned in the response to the create/rotate call. From then on, only a SHA-256 hash is stored — LobThat itself cannot show it to you again.

Rotating without downtime

Rotation deprecates the current key and issues a new active one in a single step — both remain valid until you explicitly finish the rotation, so in-flight deploys of your old key don't start failing mid-rollout.

Rotate old key: deprecated (still works) new key: active roll out new key revoke old key
One rotation in flight at a time
You can't start a second rotation while a deprecated key still exists for an Application — finish (revoke the old key) or the rotation call is rejected, so you can't accidentally lose track of which key is actually in use.
Known limitation: each Application has exactly one active key at a time (plus, during rotation, one deprecated key). Some competitors support multiple independently-revocable keys per application for per-consumer isolation — this isn't supported yet.