Verified BursaPay workflow: Manage the lifecycle of developer API keys without unnecessarily exposing credentials.
1. Overview & Purpose
The developer portal supports key rotation, disabling and deletion controls depending on key type and approval rules.
2. Requirements & Setup
The developer must have access to the API Keys area and required 2FA/approval for protected live actions.
3. Step-by-Step Workflow
- Identify the key by its prefix.
- Rotate when the credential is suspected compromised or when scheduled rotation is due.
- Disable temporarily when immediate blocking is needed.
- Delete only when the key should never be reused.
4. Rules & Troubleshooting
Rotation invalidates the previous credential. Treat a rotated key as compromised if it was exposed.
5. Verification & Next Steps
Update all application secret stores before the old credential is intentionally disabled.