Guides
API Keys
One key authenticates every publish call your Application makes. Keys are scoped to a single Application — a key for one Application can never publish events into another.
Shown once, stored as a hash
The plaintext key (whk_...) is only ever returned in the response to the create/rotate call. From then on, only a SHA-256 hash is stored — LobThat itself cannot show it to you again.
Rotating without downtime
Rotation deprecates the current key and issues a new active one in a single step — both remain valid until you explicitly finish the rotation, so in-flight deploys of your old key don't start failing mid-rollout.
Rotate
→
old key: deprecated (still works)
→
new key: active
→
roll out new key
→
revoke old key
One rotation in flight at a time
You can't start a second rotation while a
deprecated key still exists for an Application — finish (revoke the old key) or the rotation call is rejected, so you can't accidentally lose track of which key is actually in use.
Known limitation: each Application has exactly one active key at a time (plus, during
rotation, one deprecated key). Some competitors support multiple independently-revocable keys
per application for per-consumer isolation — this isn't supported yet.