API keys

How Kovca API keys are created, stored, and revoked.

Format

Keys start with kvc_ followed by 43 URL-safe characters (256 random bits from a cryptographically secure generator). The dashboard shows the first 12 characters, such as kvc_AbC1dE2f, so you can tell keys apart.

Creating keys

  1. Open API keys in the dashboard.
  2. Click Create key and give it a descriptive name, such as production-helpdesk.
  3. Copy the full key from the dialog. It is shown only once.

Storage

Kovca never stores the plaintext key. It stores a SHA-256 hash and the display prefix. If you lose a key, create a new one and revoke the old one.

Revoking keys

Revoke a key from the dashboard. Revocation takes effect immediately: requests using the key receive 401 UNAUTHORIZED. Revoked keys stay listed for reference and can't be restored.