API
Generate a key here and paste it into the machine — no secret is sent to anybody.
Machine keys
Every token the estate holds, smallest blast radius first. Open a key to see what it is, where it comes from, how it rotates and how to install it.
- Rotating is safe by default. The old key keeps working for 24 hours, so a mistyped paste cannot take a machine down while you fix it.
- Think it leaked? Tick kill the old key immediately, or use Revoke this key on the exact key you want gone. Grace is the wrong behaviour when the point is that the old value must stop working now.
- ⚠️ A key still being used after you rotated means the rotation never finished. Each live key shows its own Uses and Last used — that is how you tell.
- Nothing here can be looked up afterwards. Only a hash is stored, so a lost key is replaced, never recovered.
- Every generate, rotate and revoke asks first, and the dialog names the key. These buttons look alike on purpose — the confirmation is the safeguard.
- ⚠️ “No button” does not mean “do not rotate” — two of these are Google-issued and rotate with a native two-key overlap, no outage window.