Handling Exposed API Keys

If you suspect that an API key has been exposed, rotate or expire it as soon as possible.

There are two ways to handle an exposed API key:

• Regenerate the key: Replaces the current key with a new one while preserving the data associated with it.

• Expire the key: Stops the key from working permanently. Use this when the key is no longer needed.

Important: Customers using Notifications or Virtual Accounts should choose one of the regeneration paths below. Expiring a key permanently deletes its associated Virtual Accounts and Notification subscriptions.

Important: Customers using only Data API or RPC product can safely generate a new key and expire the old one as there's no key state for these 2 products.

Regenerate an API Key

Regeneration replaces the existing API key with a new one. There are two ways to complete this process, depending on whether you prefer simplicity or minimizing downtime.

Option 1: Quick regeneration

Choose this option when a brief downtime is acceptable.

1. Log in to the Tatum Dashboard.
2. Go to the API Keys page.
3. Find the exposed API key.
4. Open the (⋮) menu.
5. Click Regenerate Key.
6. Update the key everywhere it is used.

When you regenerate a key, the old key stops working immediately. Requests may fail until you update your application with the regenerated key.

For Notifications and Virtual Accounts, the data associated with the original key moves to the regenerated key.

Option 2: Regenerate without expected downtime

Choose this option if you want to keep your integration running while the rotation is completed.

1. Log in to the Tatum Dashboard.
2. Go to the API Keys page.
3. Create a new API key.
4. Update your application to use the new key.
5. Confirm that requests are succeeding with the new key.
6. Find the exposed key, open the (⋮) menu, and click Regenerate Key.
7. Update your application to use the regenerated key.

The newly created key handles requests while you regenerate the exposed key, helping avoid the downtime that can occur with the quick regeneration path.

For Notifications and Virtual Accounts, activity created while the temporary new key is active remains associated with that key. After the rotation is complete, review and migrate or reconcile that activity with the regenerated key as needed.

Expire an API Key

Expire an API key when you no longer need it and want to stop it from working permanently.

1. Log in to the Tatum Dashboard.
2. Go to the API Keys page.
3. Find the exposed API key.
4. Open the … menu.
5. Click Delete.
6. Confirm the deletion.

Warning: Expiring an API key permanently deletes all associated Virtual Accounts and Notification subscriptions. This action cannot be reversed.

After Rotation or Expiration

• Update any application code, environment variables, deployment settings, and third-party integrations that use the affected key.
• Remove the exposed key from source control, logs, tickets, chat messages, and other shared locations.
• Review application activity for unexpected behavior.