API Key and Token Service  ·  View 05 of 22  ·  Act 2 · People and journeys

Journey — a live key in a public commit

The journey the whole architecture exists for, and its worst moment is not the one you would guess.

Editable source SVG draw.io All views
Customer security engineer paged at 21:40 Goal — Make the leaked credential useless before anyone else uses it Trigger — A scanning partner matched the key prefix in a public commit Done when — The key is dead everywhere, and the blast radius is written down 1 · Leak commit pushed 2 · Detect 3 · Decide ◆ moment of truth 4 · Contain ◆ moment of truth 5 · Account for it What they do Reads the alert Checks blast radius Confirms revoke Watches propagation Exports the trail Issues a successor What the platform does Key is live and usable Partner live-or-not check Policy: revoke or downgrade Feed reaches every point Full decision trail How it feels In control Tense Losing it Where it hurts Nobody knows yet Is this our key or a test one? Revoking breaks production Is it dead everywhere yet? What did it touch? What we do about it Prefix makes it greppable Environment in the prefix Downgrade to read-only Propagation shown live, p99 ≤ 10 s Usage attributed per key Journey — customer security engineer, a live key in a public commit The trough is Decide, not Detect. The revoke button is easy; the blast-radius answer is what makes pressing it possible. v 1.0 · owner Security Platform Architecture · date 2026-09

The finding

  • The trough is Decide, not Detect. Detection is a partner integration and a prefix format; the hard moment is a human deciding to revoke while not knowing what breaks.
  • That makes blast radius — which resources this key touched, from where, how recently — a structural requirement, not a reporting feature.

What answers it

  • Downgrade-to-read-only as a containment option between "do nothing" and "break production".
  • Usage attributed per credential, so the blast-radius question has an answer before the decision rather than after it.
  • Propagation shown live, so "is it dead yet" is a number on a screen and not a belief.

Assumptions

  • Leak-to-action p99 ≤ 60 s from partner notification — invented, and the number that makes the partner integration worth building.
  • Auto-revoke is the default for a confirmed partner match; anomaly-only auto-revocation is opt-in.
◀  Journey — the first API call All views Layered Architecture  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0905-journey-key-on-github