Skip to main content
You need an evaluation key whenever a new system should call a deployed application, and you revoke it when that system stops calling or the key was seen by someone who should not have it.

​
Before you start

  • The application is deployed to the environment (Deploy a release and call it).
  • To create and revoke keys, you hold key:mint and key:revoke in the environment, for example as an operator. To see the list of keys, you hold binding:read, for example as an auditor. Who may do what lists the roles.
  • You can sign in to the Admin UI of the runtime cluster, for example https://cluster.example.com/runtime-management/ui/.

​
Create a key

1

Open the application

Open the Admin UI and click Sign in with Leapter. Choose the environment in the environment list at the bottom of the sidebar. On the Status page, click the application’s name. The application’s page opens.
2

Start a new key

Scroll down to the Keys card and click Create key.
The application page of pizza-pricing-calculator-180269. The Keys card says This application has no key in this environment. The Create key button has a green ring.

The Keys card with Create key.

3

Name the calling system

In Used by, type the system that will hold the key, for example pizza-shop. An operator reads this before they revoke a key, to know what stops working. In Reason, type why the system needs the key. Click Create.
The dialog Create an evaluation key with Used by pizza-shop and Reason The pizza shop shows prices from this release. The Create button has a green ring.

The dialog Create an evaluation key.

4

Copy the key and give it to the system

In Copy this key now, the dialog says “Nothing has been copied yet. Done drops this value for good.” Click the copy button next to the key. Copied appears. Give the key to the calling system, for example as a secret in its configuration. Then click Done. The Admin UI never shows the key again.
The dialog Copy this key now. The key field shows lk_dev_ followed by dots. The copy button has a green ring, Copied is shown below the field, and Key id and Used by are listed.

The key is shown only once.

The new key is in the Keys table with the state Active. A new key needs up to about a minute before calls with it work. Until then, calls with it get 401 Unauthorized, and calls to an application that had no key before get 404 page not found.

​
Revoke a key

1

Find the key

On the application’s page, find the key in the Keys table. Used by tells you which system holds it.
2

Revoke it

Click the actions button (…) at the end of the key’s row and choose Revoke. In a narrow window, the table scrolls sideways: scroll it to the right to see the button. In Revoke this key, type why in Reason and click Revoke this key.
The dialog Revoke this key. It says Nothing is deleted: the key is marked revoked and stays in this list, and pods stop accepting it within about a minute on a default install. Key id and Used by pizza-shop-test are listed, Reason is filled in. The Revoke this key button has a green ring.

Revoking marks the key as revoked. Nothing is deleted.

3

Check the result

The dialog changes to The key is revoked and shows Revoked with the time, and By with your principal as leapter cluster whoami prints it, for example oidc:supabase:0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d. Click Close. In the Keys table, the key’s state is Revoked.
To give the system access again, create a new key.

​
Result

The calling system has a key of its own, and you can take it away without touching the keys of other systems. Within about a minute of a revocation, calls with the revoked key get the answer 401 Unauthorized:

​
Troubleshooting

After Sign in with Leapter, you are in the Lab and not in the Admin UI. Open the Admin UI’s address again and click Sign in with Leapter once more. You are signed in now, so the Status page opens. The Keys card shows no table, but a sentence that starts with “You need the binding:read right”. You may create and revoke keys, but not see the list. Ask an auditor or an admin of the environment to look up a key for you. The Keys card has no Create key button. You may see the keys, but not create or revoke them. The card says “You need the key:mint and key:revoke rights”. Ask an operator or an admin of the environment.

​
What to do next