API keys

An errorcore API key is a server-side bearer credential. It authenticates one project and environment to the ingest API and is the sole source of tenant scope for every envelope you send.

Format: ec_live_ followed by 32 to 128 URL-safe characters.

It is not a license key and not a billing credential. Plan limits are enforced against your organization account, not against the key; see billing and usage.

Issue a key

Console → Settings → API keys → Create key, or the credentials step in Setup. Creating a key requires an organization admin and recent identity verification.

The plaintext is shown exactly once, with an explicit acknowledgement before you continue. errorcore stores only a keyed digest, the prefix, and the last four characters, so a lost key cannot be recovered, only replaced.

Put the value in your server-side secret store and expose it to the process as ERRORCORE_API_KEY.

Use it

import { init } from "errorcore";

init({
  transport: {
    type: "http",
    url: process.env.ERRORCORE_INGEST_URL ?? "https://api-production-7ecf.up.railway.app/v1/ingest",
    apiKey: process.env.ERRORCORE_API_KEY,
  },
  encryptionKey: process.env.ERRORCORE_DEK,
});

transport.apiKey and transport.authorization are mutually exclusive; configuring both throws at startup. Use authorization only for a custom collector that needs a non-bearer scheme.

Statuses

Rotate

Rotation issues a new key and starts a bounded grace period (0 to 86,400 seconds) during which the previous key still authenticates. Deploy the replacement within that window, then let the old key expire.

The replacement plaintext is shown once, exactly like a new key.

Revoke

Revocation takes effect immediately. Every request using the key is rejected from that moment, and events sent with it are not admitted. Revoke as soon as a key may have leaked.

If a key leaks

1. Revoke it in the console.
2. Issue a replacement and deploy it.
3. Check Admissions for events admitted with that key id during the exposure window.

Because payloads are encrypted with your ERRORCORE_DEK and not with the API key, a leaked API key does not by itself expose payload content. It does allow sending events into your project, which consumes your plan allowance.

Operational rules

• Server-side only. Never in browser code, never behind a public env prefix.
• One key per deployment surface makes revocation cheap.
• The key never appears in logs, URLs, or the console after its one-time display.