Scopes
Grant the smallest set that supports the integration.Key-management endpoints use an authenticated dashboard session, not a workspace API key. This prevents an API key from minting or escalating other credentials.
One-time reveal
The plaintext secret is returned only when a key is created or rotated. Infragrid stores a hash and safe metadata such as the prefix, scopes, timestamps, and status. If you lose the value, rotate or replace the key. It cannot be recovered.Rotation
1
Create the replacement
Rotate the key in Developer settings and choose a grace period from zero to seven days.
2
Deploy the new secret
Update the secret manager and restart or redeploy every consumer.
3
Verify usage
Confirm calls succeed with the replacement and that the old key is no longer used.
4
End the overlap
Revoke the old key immediately, or let the bounded grace window expire.
Environment variables
The SDKs and MCP adapter read:INFRAGRID_BASE_URL only for an explicitly selected preview or self-hosted API. The CLI also accepts INFRAGRID_API_URL and gives it precedence for compatibility.
Idempotent mutations
Add a stable idempotency key before enabling automatic retries for run creation.