API Key Lifecycle Management

An API key should have an owner, purpose, and end date for review even when the credential itself has not expired. Lifecycle management reduces the time and systems affected by accidental exposure.

Plan before creating

Identify the application, responsible owner, allowed egress addresses, required endpoints, storage location, monitoring contact, and replacement procedure.

For API Key Lifecycle Management, treat “Plan before creating” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Capture plaintext once

MangoOTP returns a key with the mago_live_ prefix only in the creation response. Save it directly to protected secret storage and do not copy it into tickets.

For API Key Lifecycle Management, treat “Capture plaintext once” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Maintain the IP whitelist

A non-empty whitelist is mandatory. Use the narrowest practical IPv4 or CIDR ranges and update deployment addresses before traffic moves.

For API Key Lifecycle Management, treat “Maintain the IP whitelist” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Run with one active key

Each user can have at most one active key. Do not attempt to create overlapping live keys or share one key across unrelated owners.

For API Key Lifecycle Management, treat “Run with one active key” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Monitor safe identifiers

Use the display prefix, request result, code, and traceId for operations. Never log the raw key, stored hash, or authorization header.

For API Key Lifecycle Management, treat “Monitor safe identifiers” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Revoke on exposure or retirement

Revocation makes the active key unusable immediately and removes it from the active list. Confirm dependent systems stop using it.

For API Key Lifecycle Management, treat “Revoke on exposure or retirement” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Create the replacement deliberately

A replacement can be created only after the previous key is revoked. Update protected configuration and run a controlled verification request.

For API Key Lifecycle Management, treat “Create the replacement deliberately” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Manage the webhook secret separately

Webhook configuration belongs to the active key. The signing secret is shown when created or rotated and should be stored and replaced independently.

For API Key Lifecycle Management, treat “Manage the webhook secret separately” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Practical checklist

1. Verify plan before creating, record the result, and continue only when the next action is clear.
2. Verify capture plaintext once, record the result, and continue only when the next action is clear.
3. Verify maintain the ip whitelist, record the result, and continue only when the next action is clear.
4. Verify run with one active key, record the result, and continue only when the next action is clear.
5. Verify monitor safe identifiers, record the result, and continue only when the next action is clear.
6. Verify revoke on exposure or retirement, record the result, and continue only when the next action is clear.
7. Verify create the replacement deliberately, record the result, and continue only when the next action is clear.
8. Verify manage the webhook secret separately, record the result, and continue only when the next action is clear.

Use the final platform status and account history as the source of truth. Do not share passwords, full verification codes, authentication secrets, access tokens, or API keys in screenshots or support messages. More guidance is available in the MangoOTP Help Center.