Affitor
‹ All updates

Know when your API key must be replaced

If Affitor flags your program's API key for replacement, your dashboard, every API response and the CLI now tell you. After the deadline the old key is refused.

BreakingBrandsDevelopersAPICLIDashboard
Action required. Brands: If your dashboard shows an API key notice, regenerate the key in Settings > API Key and update it on your server.

Sometimes a key has to be replaced, for example when it has been exposed outside your control. Until now there was no visible signal. Now there are three, and they all point to the same fix. Keys that are not flagged are not affected.

In the dashboard

A banner appears at the top of every brand page for that program, with a Replace key button. It opens Settings, API Key, where Regenerate creates a new key and clears the notice.

Dashboard notice: Replace your API key, with a Replace key buttonDashboard notice: Replace your API key, with a Replace key button

In API responses

Until the deadline, every response made with the flagged key carries standard headers, and JSON object responses also carry a warning:

Deprecation: @<unix time>
Sunset: <your deadline>
Link: <https://affitor.com/docs/api-reference/errors#api_key_rotation_required>; rel="deprecation"

After the deadline, requests with the old key get 401 with error.code set to api_key_rotation_required.

In the CLI

From affitor 0.4.2 (on npm since Oct 12), the CLI prints a one-line warning while the key still works, and points a retired key to the API Key page instead of suggesting affitor init.

See Errors: api_key_rotation_required to handle it in code.