Auth
Client secrets
How keys are minted, stored, rotated and revoked.
Minting
Credentials tab → Generate secret. The response contains the plaintext once. DevSewa stores a SHA-256 hash and the visible prefix (for example dsk_live_9f2c1a) so you can tell keys apart later.
Authorization: Bearer dsk_live_9f2c1a_kq9…Rotation without downtime
- Generate a second secret.
- Deploy your backend with the new value.
- Revoke the old prefix. Requests signed with it fail with
401 client_secret_invalidfrom that moment.
If a secret leaks
Revoke it immediately; there is no grace period and nothing to recover. Keys are audited on mint and revoke, so you can see when it happened.