Marketplace API Key Identity and Scope — Credential Lifetime Management Explained

An API key should be treated as a credential tied to a single tenant identity, a specific permission set, and a limited validity period. Store only a verifier, verify the revocation on every request, and record the resolved tenant and key identifiers in immutable usage events. This design ensures marketplace requests remain traceable, especially when invoices depend on them.

The primary concern is accurate billing. Using an API key that merely confirms someone knows a secret is insufficient. If two sellers share it or authorization is reconstructed from mutable account data, the invoice trail cannot reliably identify the charge producer. For individual SaaS providers, this approach also impacts revenue-per-hour decisions.

The smallest working credential boundary keeps secret storage replaceable later, focusing on the marketplace's unique usage model rather than custom cryptography or a home-grown vault. To manage API key identity, scope, and lifetime, separate these four concerns into distinct components. The stored meaning should answer the request-time question of which tenant should receive this usage.

The scope defines allowed actions, such as orders:read, orders:write, or usage:submit, and should be evaluated before the operation. The lifetime includes issuance, rotation overlap, expiry, and revocation, with a valid-now check. Verification involves a one-way digest of random secret material, comparing the presented secret against the stored digest.

The key ID should be non-secret, and the secret material unpredictable. A presented value can have a shape like mk_keyId_secret, allowing indexed lookup by key ID before verification. Keep the secret visible only once; store its digest in the database. These boundaries define the minimum requirement for a working credential system.

This example separates persistence behind an interface, with production implementation requiring durable creation and revocation storage, and UTC timestamps for timestamps. Node's standard cryptography module provides random bytes, SHA-256, and constant-time comparison; reinventing cryptography adds risk without improving the marketplace.