Key Overview

Solenoid Key is the API key management service that handles provisioning, rotation, and validation for all Solenoid products.

Create scoped API keys, verify them at sub-millisecond latency, and track usage without building key infrastructure yourself.

What makes Key different

Keys use a three-part format (prefix_entropy_checksum) that enables instant format validation at the edge before any database lookup. Negative results are also cached to block repeated lookups for invalid keys.

Capabilities

  • Create keys with custom prefixes, scopes, and metadata
  • Verify keys in sub-millisecond via edge KV cache
  • Rotate keys with configurable grace periods (1-720 hours)
  • Revoke keys with immediate cache invalidation
  • Track last-used time, IP, and user agent per key

Key format

[prefix]_[entropy]_[checksum]
  • Prefix: customer-defined, 1-32 chars (e.g. myapp_live, sk_prod)
  • Entropy: 256-bit random value, Base62-encoded (43+ chars)
  • Checksum: CRC32 for instant format validation without a database call

Scope model

Keys carry explicit scopes as string arrays — no wildcards or inheritance. Define whatever scope vocabulary makes sense for your application (e.g. orders:read, billing:admin).

Verification performance

  1. Checksum validation — edge, O(1), no network. Rejects malformed keys instantly.
  2. KV cache lookup — sub-millisecond for hot keys.
  3. Database verification — on cache miss, bcrypt verification with metering (~10-20ms).

Revocation and rotation both invalidate all cache layers within ~2 seconds.

Pricing

Verification costs 1 credit per call. Management operations (create, rotate, revoke, list, get) are free. See Pricing for tier details.

Use cases

  • SaaS API authentication for your customers
  • Third-party integrations requiring scoped access
  • Multi-tenant applications with per-customer keys
  • Mobile/desktop apps needing user-specific keys
  • Internal service-to-service authentication

Next steps