Docs/API reference/Credentials

Credentials

Server credentials sign publish requests. The secret is returned once, at creation, and never again.

API· 4 min read

Endpoints

Credentials are nested under an application and scope-bound to it, so a credential from another app returns 404 instead of being acted on (prevents IDOR).

Method	Path	Description
GET	…/applications/{application}/credentials	List credentials
POST	…/applications/{application}/credentials	Create a credential
POST	…/credentials/{credential}/rotate	Rotate a credential
DELETE	…/credentials/{credential}	Revoke a credential

Create a credential

bash

curl -fsS -X POST \
  https://api.emitwave.com/api/platform/applications/<APP_ID>/credentials \
  -H "Authorization: Bearer <API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"name":"server"}'

The response contains the public key and the secret. Use these as key and secret in a server SDK.

Rotate & revoke

Rotate a credential to issue a fresh secret without downtime — publish with the new credential, then revoke the old one once no traffic uses it. Revoked credentials are rejected by the gateway with CREDENTIAL_REVOKED.

The one-time secret

The credential secret is returned once, at creation (and on rotation), and never again. Store it securely the moment you receive it. If you lose it, rotate the credential to get a new one.

← Previous

Applications

Webhooks