Clés API pour MCP : bonnes pratiques pour rotation, révocation et séparation

Operational guide for managing API keys used by MCP clients. Learn how to create separate keys per machine, establish naming conventions, implement rotation schedules, handle revocation, and respond to security incidents.

Why Separate Keys Per Machine/Client?

Creating a unique API key for each AI assistant or machine provides critical security and operational benefits:

Security Benefits

Isolation: If one key is compromised, others remain safe
Granular Control: Revoke access for one client without affecting others
Limited Blast Radius: Compromise is contained to one device/client
Easier Investigation: Know exactly which key was used in an incident

Operational Benefits

Audit Trail: Track which client made which changes
Usage Monitoring: Monitor API usage per client
Selective Rotation: Rotate keys independently
Team Management: Assign keys to specific team members

Naming Conventions

Use descriptive names for your API keys to make management easier. Good naming helps you quickly identify which key to revoke or rotate.

Recommended Naming Pattern

Format: [client-name]-[machine/device]-[purpose]

claude-desktop-macbook-pro
cursor-work-laptop
windsurf-dev-machine
continue-personal-pc
claude-desktop-home-office

Naming Best Practices

Be Specific: Include enough detail to identify the device
Use Hyphens: Avoid spaces and special characters
Include Context: Add location or purpose if relevant
Keep It Short: Long names are harder to manage
Be Consistent: Use the same pattern across all keys

Rotation Schedules

Regularly rotating API keys limits exposure and reduces risk. Choose a schedule based on your security requirements:

High Security: Every 30-60 Days

Recommended For:

Production environments with sensitive data
Enterprise customers with compliance requirements
Keys with broad access permissions
High-value or critical workflows

Standard: Every 90 Days

Recommended For:

Most team environments
Standard project management workflows
Balanced security and operational overhead

Low Risk: Every 180 Days

Recommended For:

Personal use or small teams
Read-only or low-risk operations
Development/testing environments

Setting Up Rotation Reminders

Create a system to track rotation schedules:

Calendar Reminders: Set recurring calendar events for each key
Task Management: Create tasks in Corcava for key rotation
Spreadsheet: Track key creation dates and next rotation dates
Automated Alerts: Use your team's notification system

Revocation Process

When you need to revoke an API key (rotation, compromise, or access removal), follow this process:

Step-by-Step Revocation

Identify the Key
Go to Corcava Settings → Integrations → Public API. Find the key you want to revoke by its name.
Create Replacement Key (If Needed)
If you're rotating (not just revoking), create the new key first and copy it securely.
Update Client Configuration
If rotating, update the MCP client's configuration file with the new key before revoking the old one.
Revoke the Old Key
In Corcava Settings → Integrations → Public API, click Delete or Revoke on the old key.
Restart the Client
If you updated the configuration, restart the AI client to load the new key.
Verify Access
Test that the client can still access Corcava (if rotating) or confirm access is blocked (if revoking).

⚠️ Important

Revoking a key immediately stops all access. The AI client will start getting 401 errors. If you're rotating, make sure you have the new key ready and the client configuration updated before revoking the old key.

Incident Response: If a Key Leaks

If you suspect an API key has been compromised or leaked, act immediately:

Immediate Actions (Within Minutes)

Revoke the key immediately in Corcava Settings → Integrations → Public API
Review recent activity in audit logs to identify unauthorized access
Check for unauthorized changes (tasks created, data modified, time logged)
Notify team members who may be affected

Investigation Steps

Review Audit Logs: Check Corcava audit logs for unusual activity patterns
Identify Scope: Determine what data was accessed or modified
Check Timestamps: Note when unauthorized access occurred
Review Changes: Examine any tasks, comments, or data that was created/modified
Assess Impact: Determine if sensitive data was exposed

Recovery Steps

Create New Keys: Generate new API keys for legitimate clients
Update Configurations: Update all MCP client configs with new keys
Restart Clients: Restart AI clients to load new keys
Verify Access: Test that legitimate clients can still access Corcava
Review Security Practices: Identify how the key leaked and prevent recurrence