Rotate or revoke an API key

Answer: in the dashboard, create a new key, deploy it, then revoke the old one. A revoked key gets 401 invalid_key on REST and on new WebSocket connections, and any open WebSocket using it is closed with code 4001 key_revoked. Paid plans can hold up to 20 active keys, so zero-downtime rotation is easy. Free has one active key: revoke it first, then create the replacement.

Zero-downtime rotation (paid plans)#

1. Dashboard → Create key, name it (for example bot-2026-11). The full ps_live_... value is shown once; PinnFeed stores only a hash and the first 12 characters.
2. Put the new key in your secret store or environment (PINNFEED_KEY) and redeploy.
3. Check the old key's last used time in the dashboard stops moving.
4. Revoke the old key. Any client still on it gets 4001 (WebSocket) or 401 (REST).

Handle 4001 in code#

ws.on('close', (code, reason) => {
  if (code === 4001) {
    console.error('key revoked: load the new PINNFEED_KEY before reconnecting');
    return;                        // do not reconnect in a loop with a dead key
  }
  scheduleReconnect();
});

Good habits#

• One key per app or environment, so a leak only means revoking one.
• Never ship a key in browser or mobile code: browser apps.
• Prefer the x-api-key header over ?key=; URLs end up in logs.

Auth basics: authentication · error codes.

Plans#

Free: one active key, REST, 30 s delay. Paid plans: up to 20 active keys. Builder (€99/mo) adds the WebSocket. 3-day trial; a card is required and it is charged after day 3 unless you cancel.

Educational content for adults (18+).

Questions people ask#

Can I see a key again after creating it?#

No. Only the prefix is kept; create a new key if you lost it.

Do keys share rate limits?#

The REST rate limit is applied per key, while WebSocket connection caps count across your account.

Can I rename a key?#

Yes, from the dashboard; renaming does not change the key value.