Skip to content
phonebase console

Keys

How a server, a CI job or an MCP client authenticates to phonebase. Your browser session is not one of these — it signs you into this console, and it is deliberately the only credential a browser may hold. A key's plaintext is shown once, when it is minted, and a hash is all that is kept.

Data source
Fixture control— not product UI. Switches which state this screen is rendering.

Every state this face has to render at once: a key in its rotation grace window, one expiring, one expired, one revoked, one never used, and one narrowed to a device subset.

A rotation is in progress

Both keys in each pair authenticate until the old one expires. Deploy the new key before then and nothing goes down. This is reconstructed from the pair — no single key row records it.

  • ci-runner pbk_live_3Hn8K stops working in 20h 00m —

    Replaced by pbk_live_7Q2vX, which is live now. Until the deadline above, either key works.

API keys

One row per key this organization has issued, live or not.

  • 1 Revoked
  • 1 Expired
  • 2 Expiring soon
  • 2 Active

A key's plaintext is shown once. It appears in the response that mints it and is never returned again — not by this console, not by the API, not by support. What is stored is a hash, which is why the list can show you a key's name, scopes and last use but never the key itself.

  • Key lifecycle: Active
    ci-runnerpbk_live_7Q2vXrotated successor
    • devices:read
    • devices:act
    Last authenticated
    11m ago
    Devices
    every device in this organization
    Created
    Expires
    expires in 89d
  • Key lifecycle: Active
    arm-lab-readonlypbk_live_5Rk4B
    • devices:read
    Last authenticated
    never — nothing has used this key yet
    Devices
    dev_robotarm_r04, dev_robotarm_r07
    Created
    Expires
    expires in 88d
  • Key lifecycle: Revoked
    contractor-accesspbk_live_8Ld6Y
    • devices:read
    • devices:act
    • devices:lease
    Last authenticated
    7d ago
    Devices
    dev_pixel7_a19
    Created
    Revoked

    Someone withdrew this key. It authenticates nothing, and there is no route that brings it back — the API answers every request addressing it exactly as it answers an id that never existed.

  • Key lifecycle: Expiring soon
    ci-runnerpbk_live_3Hn8K
    • devices:read
    • devices:act
    Last authenticated
    3h ago
    Devices
    every device in this organization
    Created
    Expires
    expires in 20h 00m

    Inside two weeks of its expiry. Rotate it rather than replacing it — a rotation leaves this key working for a grace window, so nothing that uses it goes down while the new one is deployed.

  • Key lifecycle: Expiring soon
    nightly-regressionpbk_live_9Wm2T
    • devices:read
    • devices:act
    • devices:lease
    • tasks:run
    Last authenticated
    26h ago
    Devices
    every device in this organization
    Created
    Expires
    expires in 9d

    Inside two weeks of its expiry. Rotate it rather than replacing it — a rotation leaves this key working for a grace window, so nothing that uses it goes down while the new one is deployed.

  • Key lifecycle: Expired
    old-laptoppbk_live_2Fj7N
    • devices:read
    • devices:act
    Last authenticated
    35d ago
    Devices
    every device in this organization
    Created
    Expires
    already expired

    Past its expiry. It can still be rotated, and rotating is the way back: a rotation keeps this key's name, scopes and device narrowing, where creating a new one starts from nothing. It cannot be renewed in place.