API Key and Token Service  ·  View 02 of 22  ·  Act 1 · Context and scope

High-Level Architecture

Six stages from a developer pressing "create" to a leaked key being useless everywhere.

Editable source SVG draw.io All views
Issue Developer console Cloud Run Management API GKE Record Credential store Cloud Spanner Digest pepper Cloud KMS HSM Distribute Revocation log append-only, ordered Revocation feed Pub/Sub + poll Snapshot objects Cloud Storage Verify Verification point sidecar or library Local projection digest map + overlay Staleness guard 120 s ceiling Observe Usage counters Bigtable Audit store BigQuery + GCS Contain Leak response revoke · downgrade · quarantine Revocation canary issue → revoke → re-verify write record digest revocation intake warm start sampled use bulk revoke measures p99 High-Level Architecture — from issuance to a dead key Application we own Interface / broker Data store Security / platform Queue / topic Decision point synchronous event / async batch failure / alternate The verification stage makes no call to the issue or record stages. That is the architecture. v 1.0 · owner Security Platform Architecture · date 2026-09

The shape

  • Issue and Record are rare, transactional and centralised. Verify is constant, local and replicated. Nothing in Verify calls anything in Issue or Record.
  • Distribute is the component that does not exist in the naive design, and it is where the correctness of the whole system lives.
  • Contain is a first-class stage rather than a runbook: the leak response and the canary are built, deployed and measured.

Numbers on this page

  • Verification p99 ≤ 3 ms in-process; ≤ 15 ms for the remote fallback.
  • Revocation propagation p50 ≤ 2 s, p99 ≤ 10 s, hard ceiling 60 s.
  • Staleness ceiling 120 s without a successful feed poll, after which privileged scopes are refused.
  • All three are stated assumptions, and the first two are the numbers the canary measures in production.

Risks

  • A verification point that silently stops receiving revocations looks exactly like a healthy one. The heartbeat and the staleness guard exist only for that.
  • The snapshot path is the cold-start dependency; a fleet-wide restart with no snapshot is the one scenario that would put load on the credential store.
◀  System Context All views Actors and their Journeys  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0902-high-level-architecture