Manage API keys

Create, store, rotate, and revoke test and live keys.

SignupBear has two key environments:

Prefix	Environment	Use
sg_test_	Test	Staging and deterministic fixtures
sg_live_	Live	Production signup traffic

Store keys safely

• Keep keys in a server-side secret manager.
• Never commit keys to source control.
• Never expose keys through NEXT_PUBLIC_ or another browser-visible variable.
• Never write the full Authorization header to logs.

The raw key is shown once. SignupBear stores only a SHA-256 hash for authentication and a short prefix for identification.

Rotate a key

1. Create a replacement key in the same environment.
2. Add it to your deployment secret manager.
3. Deploy and verify a test request.
4. Revoke the old key in Dashboard > API keys.

Revocation takes effect on the next request and cannot be undone. Keep the old key active until the replacement deployment is verified.