How does V100 store API keys securely?

V100 never stores API keys in plaintext. When a key is generated, the raw key is shown once to the developer and then SHA-256 hashed for storage. The hash is encrypted at rest using Kyber+AES-256-GCM post-quantum envelope encryption. API validation compares incoming key hashes against stored hashes at 31ns via Cachee's in-memory cache, without ever reconstructing the plaintext key.

How fast is API key validation?

V100 validates API keys in 31 nanoseconds using Cachee's in-memory cache. The key hash is looked up in a Cachee-backed DashMap that runs in-process, eliminating network round-trips for key validation. This means key validation adds virtually zero latency to API requests.

SECURITY

Video API Key Management
with Post-Quantum Encryption

Video API key management controls how developers authenticate with V100's API -- from key generation and storage to scoping, rate limiting, rotation, and revocation. V100 generates v100_live_* prefixed API keys that are SHA-256 hashed for storage (plaintext is never persisted), encrypted at rest with Kyber+AES-256-GCM post-quantum envelope encryption, and validated in 31 nanoseconds via Cachee's in-process DashMap cache. Each key supports granular scopes (video:read, avatar:write, analytics:read), tier-based rate limits, per-key usage tracking, zero-downtime rotation, and instant revocation. The key management system is designed so that even a complete database breach cannot expose usable API keys.

Get API Key View Code Samples

SHA-256 hashed storage

Kyber+AES-256-GCM PQ envelope

31ns Cachee-backed validation

Key Security Architecture

V100's API key management implements defense in depth. Keys are protected at generation, storage, validation, and rotation. A database breach cannot expose usable keys because plaintext keys are never stored.

SHA-256 Hashed Storage

When a key is generated, the raw key (v100_live_abc123...) is shown to the developer exactly once. V100 immediately SHA-256 hashes the key and stores only the hash. The plaintext key is never written to disk, logged, or stored in any database. API validation computes the hash of the incoming key and compares it to the stored hash.

Plaintext key shown once, never stored

SHA-256 one-way hash (irreversible)

Database breach cannot recover keys

PQ Envelope Encryption

The SHA-256 hash is further encrypted at rest using a Kyber+AES-256-GCM post-quantum envelope. The data encryption key (DEK) is encrypted by a key encryption key (KEK) using ML-KEM-768 (Kyber) key encapsulation. This protects key hashes against future quantum attacks on the storage layer.

ML-KEM-768 key encapsulation for DEK

AES-256-GCM for hash encryption

Quantum-safe even if hash is extracted

31ns Cachee Validation

API key validation runs in 31 nanoseconds using Cachee's in-process DashMap cache. When a request arrives, V100 computes the SHA-256 hash of the presented key and looks it up in the Cachee cache -- no database round-trip, no network call. This adds virtually zero latency to API requests.

In-process DashMap (zero network overhead)

31ns lookup latency

Cache invalidation on revocation (instant)

Per-Key Scopes

Every API key has a defined set of scopes that control which resources and actions it can access. Follow the principle of least privilege -- create keys with only the permissions they need. A key scoped to video:read cannot start recordings or manage webhooks.

video:read, video:write

recording:read, recording:write

transcription:read, avatar:write, analytics:read, webhook:manage

API Key Lifecycle

V100 manages the complete lifecycle of API keys from generation to revocation. Every lifecycle event generates a webhook notification and audit log entry.

1

Generate

Create a new key with specified scopes and rate limits. The raw key is returned once. SHA-256 hash is computed and encrypted for storage. Key is immediately active.

2

Use and Track

Every API call using this key is validated in 31ns via Cachee. Usage is tracked per key: total requests, requests per endpoint, and requests per time window. Rate limits are enforced per key.

3

Rotate

Generate a new key and mark the old key for expiration with a grace period. Both keys work during the grace period, allowing zero-downtime migration. The old key auto-revokes when the grace period ends.

4

Revoke

Instantly invalidate a key. The Cachee cache is updated immediately, so all subsequent requests with the revoked key are rejected within milliseconds across all V100 infrastructure.

Tier-Based Rate Limits

Free tier: 60 requests/minute. Pro: 600 requests/minute. Enterprise: custom limits. Rate limits are enforced per key, not per account. Create multiple keys with different rate limits for different services.

Per-Key Usage Tracking

Track usage per key: total requests, requests by endpoint, error rates, and latency percentiles. Identify which keys are active, which are unused, and which are approaching rate limits. Export usage data via CSV.

Key Event Webhooks

Receive webhooks for key lifecycle events: apiKey.created, apiKey.revoked, apiKey.rateLimit.exceeded. Integrate with your security monitoring and alerting systems.

Integration Guide

Generate, scope, rotate, and revoke API keys through V100's management API. Key operations require an admin-scoped key.

api-key-management.js

// npm install v100-sdk
import { V100 } from 'v100-sdk';

// Use admin key for key management operations
const v100 = new V100('v100_live_ADMIN_KEY');

// Generate a new scoped API key
const newKey = await v100.apiKeys.create({
  name: 'Frontend Recording Service',
  scopes: [
    'video:read',
    'recording:read',
    'recording:write',
    'transcription:read'
  ],
  rateLimit: {
    requestsPerMinute: 300,
    concurrentMeetings: 50
  },
  expiresAt: '2026-12-31T23:59:59Z'  // Optional expiration
});
// newKey.key     → "v100_live_sk_a1b2c3d4e5f6..." (SHOWN ONCE)
// newKey.id      → "key_abc123"
// newKey.prefix  → "v100_live_sk_a1b2"

// List all keys (only shows prefix, never full key)
const keys = await v100.apiKeys.list();
// keys → [{ id: "key_abc", name: "Frontend...", prefix: "v100_live_sk_a1b2",
//   scopes: [...], lastUsed: "2026-03-28T10:00:00Z", requestCount: 12847 }]

// Rotate a key (zero-downtime)
const rotated = await v100.apiKeys.rotate('key_abc123', {
  gracePeriod: 3600    // Old key works for 1 hour
});
// rotated.newKey → "v100_live_sk_x7y8z9..." (SHOWN ONCE)
// rotated.oldKeyExpiresAt → "2026-03-28T16:30:00Z"

// Check usage for a key
const usage = await v100.apiKeys.usage('key_abc123');
// usage.totalRequests    → 12847
// usage.last24h          → 342
// usage.byEndpoint       → { "meetings.create": 89, "recordings.get": 253 }
// usage.rateLimitHits    → 0

// Revoke a key (instant)
await v100.apiKeys.revoke('key_abc123');
// Key immediately invalid across all infrastructure

REST API equivalent:

terminal

# Generate a new API key
curl -X POST https://api.v100.ai/v1/api-keys \
  -H "Authorization: Bearer v100_live_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Frontend Recording Service",
    "scopes": ["video:read", "recording:read", "recording:write"],
    "rateLimit": { "requestsPerMinute": 300 }
  }'

# Revoke a key
curl -X DELETE https://api.v100.ai/v1/api-keys/key_abc123 \
  -H "Authorization: Bearer v100_live_ADMIN_KEY"

Use Cases

Proper API key management is the foundation of API security. V100's key management system supports multi-service architectures, multi-tenant platforms, and enterprise security requirements.

Microservice Architecture

Create separate API keys for each microservice with only the scopes it needs. Your recording service gets recording:write while your analytics dashboard gets analytics:read. If one service is compromised, the blast radius is limited.

Multi-Tenant Platforms

Generate per-tenant API keys with tenant-specific rate limits. Track usage per tenant for billing. Revoke a tenant's key instantly when they churn or violate terms. Each tenant's key is scoped to their own resources.

Automated Key Rotation

Rotate keys on a schedule (monthly, quarterly) with zero downtime using the grace period feature. Both old and new keys work during the grace period. Integrate rotation into your CI/CD pipeline for fully automated key lifecycle management.

Incident Response

If a key is compromised, revoke it instantly. The Cachee cache invalidates within milliseconds, cutting off access across all V100 infrastructure. Generate a new key with the same scopes and deploy it. The revocation webhook alerts your security team.

Usage Auditing

Per-key usage tracking provides a complete audit trail of who used which API capabilities and when. Export usage data via CSV for compliance reviews. Identify unused keys that should be revoked to reduce attack surface.

Developer Environments

Create separate keys for development, staging, and production with different rate limits and scopes. Development keys have lower rate limits to prevent accidental production-level usage. Production keys have higher limits and full scopes.

Pricing

API key management is included on all plans. Key count limits and rate limits vary by tier.

Free Tier

$0/mo

Development keys.

2 API keys

60 req/min rate limit

SHA-256 + PQ encryption

Scopes + revocation

RECOMMENDED

Pro

Included

Production key management.

25 API keys

600 req/min rate limit

Key rotation + grace period

Usage tracking + CSV export

Enterprise

Custom

Unlimited keys + custom limits.

Unlimited API keys

Custom rate limits

BYOK encryption

SSO-linked key management

Video API Key Management
with Post-Quantum Encryption

Key Security Architecture

SHA-256 Hashed Storage

PQ Envelope Encryption

31ns Cachee Validation

Per-Key Scopes

API Key Lifecycle

Generate

Use and Track

Rotate

Revoke

Tier-Based Rate Limits

Per-Key Usage Tracking

Key Event Webhooks

Integration Guide

Use Cases

Microservice Architecture

Multi-Tenant Platforms

Automated Key Rotation

Incident Response

Usage Auditing

Developer Environments

Pricing

Get Your V100 API Key

Related Resources

Quantum-Safe API Keys

Webhook API

Encrypted Video Conferencing

Video API Key Managementwith Post-Quantum Encryption

Key Security Architecture

SHA-256 Hashed Storage

PQ Envelope Encryption

31ns Cachee Validation

Per-Key Scopes

API Key Lifecycle

Generate

Use and Track

Rotate

Revoke

Tier-Based Rate Limits

Per-Key Usage Tracking

Key Event Webhooks

Integration Guide

Use Cases

Microservice Architecture

Multi-Tenant Platforms

Automated Key Rotation

Incident Response

Usage Auditing

Developer Environments

Pricing

Get Your V100 API Key

Related Resources

Quantum-Safe API Keys

Webhook API

Encrypted Video Conferencing

Video API Key Management
with Post-Quantum Encryption