API keys
The /keys page lists every key minted under your tenant, across both
modes (live, test) and both types (secret dv_sk_, public dv_pk_), and
lets authorized roles mint or revoke them.
Key types
The environment and the type are both encoded in the key string. There are
no separate sandbox URLs: api.drukverify.com accepts both modes and
routes on the prefix.
| Prefix | Type | Where it lives | Used for |
|---|---|---|---|
dv_sk_live_… | secret | Server side only, never in a mobile app | Minting session tokens and verifications, server-side OCR, fraud, face and liveness calls |
dv_sk_test_… | secret | Server side, development | Same, against test-mode data and quotas |
dv_pk_live_… | public | Embeddable in your app binary | The apiKey on EkycConfig in the Flutter SDK; identifies the tenant and mode, grants nothing on its own |
dv_pk_test_… | public | Embeddable, development | Same, test mode |
Role gates
| Action | admin | developer | viewer |
|---|---|---|---|
| List keys | yes | yes | yes |
| Create a live key | yes | no | no |
| Create a test key | yes | yes | no |
| Revoke a key | yes | test keys only | no |
The same gates are enforced by the dashboard API, so a hand-crafted request
from a non-permitted role still gets a 403 forbidden.
Creating a key
Click New key and choose the type (sk or pk), the mode and an
optional name. Names appear in the list and the audit log, so "backend
(staging)" or "iOS app store build" pays off later.
After you submit, the full key value is displayed exactly once. Copy it
into your secrets manager before dismissing; the list only ever shows the
prefix afterwards (dv_sk_live_4eC3…).
Rotating a key
There is no in-place rotate button. To rotate without downtime, create a new key with the same type and mode, deploy it, confirm traffic has moved (see last-used below), then revoke the old one.
Revoking a key
Revoke is immediate: from the next request on, the key gets a
401 revoked_key. The row stays in the list, greyed out, for audit. There
is no un-revoke; mint a new key if you change your mind.
Last-used tracking
Each row shows when the key last authenticated a request. Useful for finding dead keys to revoke, and for noticing a production key that has gone quiet outside a maintenance window.