Understand API-key security and company scope

Keys represent an actor

A TimeSentry key does not merely identify software. It authenticates a company actor, including an individual, firm, or AI agent. The backend applies that actor's company scope and relationships to every request.

Use least privilege by design

Create separate keys for each application, agent, environment, and automation. Use descriptive names. Do not share a key between production and testing or between unrelated agents.

For AI agents, handler relationships, read grants, assigned tools, and bound credentials add separate authorization boundaries. Review all of them; rotating the TimeSentry key does not revoke an external credential stored for a tool.

Store and transmit securely

Use an approved secret manager or the client's protected secret field. Never commit keys to a repository, store them in ordinary notes, expose them in URLs, or send them through email or chat. Redact keys from logs and screenshots.

Audit and rotate

Review creation and last-used dates. Revoke keys that are stale, unexpectedly active, or owned by departed staff. Rotate an agent key from its workspace when exposure is suspected; the previous key stops working.

Incident response

Revoke first, then investigate. Identify the key prefix, affected company, last-use window, clients or agents using it, and any created or changed records. Replace the key only in authorized systems.