Credentials

A Credential is replaceable authentication material for one Service Account. Send its API key value in the X-API-Key header when calling authenticated public API operations. The Credential cannot widen the Service Account's scopes, change its rate policy, or move to another Project.

Reveal and storage

The raw value is shown only once after issue or rotation. It is hidden by default on the reveal screen until you explicitly choose Reveal API key. Copy it directly into a server-side secret manager; do not place it in source control, URLs, browser bundles, logs, screenshots, analytics, or support messages.

Existing Credentials expose only safe metadata such as their masked prefix, status, creation time, expiry, and last use. SteamCall cannot recover a raw value after you leave the reveal screen.

Rotation without downtime

A Service Account can have at most two active Credentials. This allows a bounded overlap:

1. Rotate or issue the replacement.
2. Store and deploy the new value.
3. Verify a bounded API request with the replacement.
4. Revoke the old Credential.

Both active Credentials use the same Service Account permissions and shared rate budget. Revoked, expired, and suspended Credentials remain in the inactive history for audit and incident review.

Request authentication

X-API-Key: your_service_account_credential

Treat 401 as a configuration or Credential-lifecycle problem. Confirm the secret source, header, and active status; do not retry the same rejected Credential in a tight loop. Keep the returned X-Request-ID for safe investigation.

Credentials are issued, rotated, and revoked in the Dashboard. The public API Reference documents the product operations those Credentials authorize, not account-management endpoints.

Continue with Authentication, Service Accounts, and Projects.