Generate and rotate API keys

Generating a key

1. Portal → Account → API Keys → Create key.
2. Name it after the service using it (example: ci-github-actions).
3. Pick the scopes it needs. Follow least-privilege — a billing-read-only key should not have VM write.
4. Copy the secret once. We never show it again.

Use it

curl https://api.orvoxa.com/v1/vms \
  -H "Authorization: Bearer $TOKEN"

Rotating

Best practice: rotate every 90 days. Create a new key with the same scopes, deploy it, then revoke the old one. No downtime if done in that order.

Revoking

If a key leaks, revoke immediately from API Keys → Revoke. Effective in under 10 seconds globally.