N4
Token management
Unit E1 · Assessment type Test
- API keys have scopes, an expiry date, rotation (new key, the old one expires after a grace period), revocation (effective immediately), and a rate limit (requests per minute, default 120, configurable per key).
- Exceeding it returns HTTP 429 with
Retry-After; revocation and expiry return 401. - The plaintext is displayed only once at creation; a hash is stored.