Skip to content
Northstack

Architecture

One key, one job

5 min read

Scoped API keys that show their secret once and never outlive their purpose.

A key does one thing

Each key names what it may do: read projects, write projects, read tasks or write tasks. A key that only reads cannot change anything, whatever the person who made it could do.

The secret is shown once

The API stores only a hash of the secret. The dashboard shows the full key once, with a copy button; afterwards only its prefix is visible, so a key in a screenshot is not a key anyone can use.

Revoking is immediate

Revoking a key names it in the confirmation and stops it at once. Every creation and revocation is written to the workspace's activity log.

Demo keys stay in the demo

Keys created in demo mode carry their own prefix, and an install that is not in demo mode refuses them.