API Keys
Preview-only status for Keva public ticket API keys
The Settings → API Keys surface is preview-only in this release and is not a production self-serve path. Production API-key creation and use are not offered. This page records what the feature does today; it is not an activation or integration runbook.
Release boundary
- The API-key route and its authenticated ticket and message operations exist in local source.
- The Settings section is admitted only when the preview release policy allows it and the API responds successfully.
- Production does not offer the API-key family. Local implementation and test coverage do not make a configured, deployed, or live production surface available.
- No official production SDK or customer-facing API-key onboarding path is offered in this release.
Local source status
The local API-key contracts record a generated-key suffix of 64 hexadecimal characters
and the public ticket endpoint https://app.keva.support/api/v1/tickets. These source
facts do not establish production availability.
The local issuance contract is not offered as a customer workflow. It accepts only the supported ticket scopes, the validation rejects empty scope sets, and the current Settings flow issues both supported ticket scopes in preview source. The source lifecycle includes no rename operation and no expiry-setting operation.
| Scope | Preview source access |
|---|---|
tickets:read | Read ticket data and messages in the bound workspace |
tickets:write | Preview documentation covers ticket updates including status, priority, and assignment; production self-serve is not offered |
Selected local rate-limit paths use a strict 300 requests per minute forwarded-source
bucket and a strict 100 requests per minute full-key-hash bucket. Missing or unavailable Redis returns HTTP 503. The forwarded-source attribution is not trusted-edge evidence;
configured Redis, deployed enforcement, edge protection, and universal coverage are not
available as a production guarantee.
Current limits
The public v1 route, key authentication, permission checks, workspace binding, and rate-limit behavior are not offered as a production customer workflow. They do not establish production availability, deployed enforcement, provider configuration, or live customer use.
Do not treat this page as instructions for creating, storing, or sending a production API key. Any development fixtures or credentials must remain outside browser code, browser storage, logs, email, chat, and committed files.