API keys & access

There are two kinds of identity: API keys for services calling /v1, and people signing in to the console. People create and manage keys; keys do the work.

API keys

Authorization: Bearer du_live_3f9a1c2b7d4e…

• A key is du_live_ followed by 48 hex characters. Only its SHA-256 hash is stored — the full key is shown exactly once, at creation. Lose it and you create a new one.
• The first 16 characters (du_live_3f9a1c2b) are kept as a prefix so you can recognise a key in the console and in usage without exposing it.
• One key works for every utility (unless you scope it) — there are no per-utility secrets any more.

Create keys in the console under API keys → Create key. Use one key per calling service — usage, latency and failures are reported per key, and you can revoke one service without touching the others.

Setting	Default	Notes
Name	—	Where the key runs, e.g. billing-service. Shown in Jobs and Usage.
Utilities	All	Restrict to specific utilities. A call to anything else answers 403 forbidden; GET /v1/utilities lists only what the key may call. "All" includes utilities added later.
Rate limit	600 / minute	Set by staff; see below.
Expires	Never	30 / 90 / 365 days. An expired key answers 401.

Rate limits

Each key has a budget of requests per fixed one-minute window, counted across every /v1 request (including GET /v1/jobs polling). Every response carries:

Header	Meaning
RateLimit-Limit	The key's per-minute budget.
RateLimit-Remaining	Requests left in the current minute.
RateLimit-Reset	Seconds until the window resets.

Over the limit you get 429 rate_limited with Retry-After (seconds). Long-poll with GET /v1/jobs/{id}?wait=30 rather than polling tightly — one request can cover 30 s of waiting.

Revoking, rotating, last used

• Revoke takes effect immediately — the next request with that key is 401. Revoked keys stay listed (after the active ones) so their jobs and usage remain attributable.
• There's no in-place key rotation: create a new key, deploy it, revoke the old one. Usage per key shows when the old one has gone quiet.
• Last used is updated at most once a minute per key.

Callback signing secret

Every key also has its own whsec_… secret for signing callbacks of the jobs it creates. It's shown with the key at creation; later, API keys → Signing secret reveals or rotates it. Keys created before per-key secrets existed use the workspace secret until you rotate theirs.

People and roles

Role	Can
Admin	Everything: all keys, jobs and usage; invite and manage members; change roles; reset another member's 2FA; rotate the console-playground signing secret.
Member	All keys, jobs and usage; create, edit and revoke any key; set rate limits; run the playground. Can't manage members.
External (guest)	Only what they own: keys they created, jobs from those keys and their own playground runs, and usage of those keys. Keys get the default rate limit (staff can raise it). No access to members or the workspace signing secret.

External accounts are for partners and vendors who integrate with Finnoto: they get a working console and their own keys without seeing anything else in the workspace.

There must always be at least one active admin; the last one can't be demoted or disabled.

Signing in

Method	Who	Notes
Google	Anyone with a verified Google account on an allowed domain (finnoto.com)	First sign-in creates a Member account automatically.
Google	Anyone with an open invite for that exact email	The invite decides the role.
Email + password	Invited people	Passwords are at least 10 characters, hashed with argon2id.

Sessions last 14 days of inactivity. Ten failed passwords for the same email from one address (or fifty overall) lock sign-in for that email for 15 minutes.

Invites

Admins invite from Settings → Members: an email and a role. The console returns a single-use link valid for 7 days — no email is sent, so copy the link and send it yourself. The person opens it and sets a name and password, or continues with Google if the invite is for their Google email. Re-inviting the same email revokes the earlier link.

Two-factor authentication

Password accounts can turn on TOTP two-factor under Settings → Security: add the setup key (or otpauth:// URI) to any authenticator app, confirm with a code, and every password sign-in then asks for a 6-digit code. Google sign-in relies on your Google account's own 2-step verification. Lost your device? An admin can reset your 2FA from Settings → Members.