What makes V100 API keys quantum-safe?

V100 API keys are wrapped in a Kyber + AES-256-GCM envelope at the gateway level. Kyber (ML-KEM) is a lattice-based key encapsulation mechanism standardized by NIST as FIPS 203. The API key material is encrypted with AES-256-GCM using a symmetric key derived from the Kyber encapsulation. Every API request is verified with an ML-DSA-65 Dilithium signature (FIPS 204). This means that even if an attacker records your encrypted API traffic today, a future quantum computer cannot decrypt the key material.

What is the scope system for V100 API keys?

V100 API keys use a granular scope system that controls which API resources the key can access. Scopes include: video:read, video:write, video:delete, recording:read, recording:write, recording:delete, transcript:read, transcript:write, avatar:read, avatar:write, meeting:create, meeting:manage, billing:read, and admin:all. You can create keys with minimal scopes following the principle of least privilege.

How fast is API key validation?

V100's API gateway validates keys in 31 nanoseconds using the Cachee in-process cache layer. This is approximately 1,000 times faster than a typical Redis lookup and adds zero perceptible latency to API requests. The Cachee layer caches the Dilithium signature verification result so that subsequent requests from the same key do not require a full cryptographic verification.

Can I rotate API keys without downtime?

Yes. V100 supports zero-downtime key rotation. When you rotate a key, a new key is generated and the old key remains valid for a configurable grace period (default 24 hours). Both keys work simultaneously during the grace period, allowing your systems to update without interruption. You can also set automatic rotation schedules (every 30, 60, or 90 days) for compliance requirements.

Does V100 track API key usage?

Yes. Every API key has detailed usage tracking that records the number of requests, bandwidth consumed, endpoints accessed, error rates, and last-used timestamp. Usage data is available through the dashboard and the API. Per-key rate limiting allows you to set request-per-second and request-per-day thresholds for each key independently.

QUANTUM-SAFE API KEYS

Quantum-Safe
API Authentication

Every V100 API key is wrapped in a Kyber + AES-256-GCM encryption envelope and verified with ML-DSA-65 Dilithium signatures at the gateway. Key validation completes in 31 nanoseconds through the Cachee in-process cache -- approximately 1,000x faster than Redis. Combined with granular scoped permissions, automatic key rotation, per-key usage tracking, and configurable rate limiting, V100 provides the most secure API authentication in the video industry.

Get API Key View Scope System

Kyber + AES-256-GCM envelope

Dilithium signature verification

31ns cache validation

Why API Key Security Matters

API keys are the front door to your video infrastructure. A compromised key grants access to video recordings, transcripts, participant data, and billing. Most API providers store keys as plaintext hashes in a database -- one breach exposes every customer. V100 applies post-quantum cryptographic protection to the keys themselves.

Key Theft is the #1 API Breach Vector

According to industry reports, exposed API keys in public repositories, client-side code, and log files are the leading cause of API breaches. V100's server-side proxy architecture ensures keys never reach client devices, and the Kyber encryption envelope means stolen ciphertext is worthless without the post-quantum decapsulation key.

Database Breaches Expose Plaintext Keys

When a provider's database is breached, API keys stored as bcrypt or SHA-256 hashes can be brute-forced. V100 stores keys encrypted with Kyber + AES-256-GCM -- even with full database access, the key material cannot be recovered without the Kyber private key, which is stored in a hardware security module and is quantum-resistant.

Rotation and Revocation are Critical

Many organizations never rotate API keys. V100 supports automatic rotation on configurable schedules (30, 60, or 90 days) with zero-downtime grace periods. Revoked keys propagate immediately across the entire gateway -- not eventually, immediately. The 31ns Cachee validation ensures revocations take effect on the next request.

Cryptographic Architecture

V100's API key security is implemented in the gateway's pq_crypto.rs module -- a Rust implementation with no garbage collection pauses and no runtime overhead. The entire key lifecycle is post-quantum protected.

Key Creation: Kyber + AES-256-GCM Envelope

When a new API key is created, the raw key material is encrypted using a Kyber key encapsulation mechanism (FIPS 203). The Kyber encapsulation produces a shared secret, which is used as the key for AES-256-GCM encryption of the actual API key. The resulting ciphertext (Kyber ciphertext + AES-GCM ciphertext + authentication tag) is stored in the database. The raw key is returned to the customer exactly once and never stored in plaintext.

Kyber (ML-KEM) AES-256-GCM FIPS 203

Request Verification: Dilithium Signatures

When an API request arrives at the gateway, the provided key is verified against an ML-DSA-65 Dilithium signature (FIPS 204). The gateway computes a signature over the key, request timestamp, and request path, then verifies it against the stored public key. This ensures the key has not been tampered with and the request is authentic. The verification is post-quantum secure.

ML-DSA-65 FIPS 204 Per-request verification

Cache Validation: 31 Nanoseconds via Cachee

After the first Dilithium verification, the result is cached in Cachee's in-process DashMap. Subsequent requests from the same key are validated in 31 nanoseconds -- approximately 1,000x faster than a Redis lookup. The cache entry includes the key's scope, rate limit state, and revocation status. Cache entries are invalidated immediately on key rotation or revocation.

31ns validation In-process DashMap Instant revocation

31ns

Cache validation

Cachee in-process

291us

Dilithium verify

First request only

0ms

Revocation propagation

Immediate cache invalidation

Rust

Gateway implementation

No GC pauses

Scoped Permission System

V100 API keys use a granular scope system following the principle of least privilege. Create keys that can only access the resources they need -- a transcription service key does not need recording deletion permissions.

Scope	Permission	Description
video:read	Read	List and retrieve video sessions and metadata
video:write	Write	Create and update video sessions
video:delete	Delete	Delete video sessions and associated data
recording:read	Read	Download and stream recordings
recording:write	Write	Start, stop, and configure recordings
recording:delete	Delete	Delete recordings and associated signatures
transcript:read	Read	Retrieve and export transcripts
transcript:write	Write	Enable and configure transcription
avatar:read	Read	List and retrieve AI avatar configurations
avatar:write	Write	Create, update, and deploy AI avatars
meeting:create	Create	Create new meeting sessions
meeting:manage	Manage	Manage participants, mute, kick, lock meetings
billing:read	Read	View usage and billing data
admin:all	Admin	Full access to all resources (use sparingly)

Integration

Create scoped API keys, configure rotation, and set rate limits through the API or dashboard.

manage-api-keys.js

import { V100 } from 'v100-sdk';

const v100 = new V100('YOUR_ADMIN_API_KEY');

// Create a scoped API key for a transcription service
const key = await v100.apiKeys.create({
  name: 'Transcription Service - Production',
  scopes: [
    'transcript:read',
    'transcript:write',
    'recording:read'       // Read recordings to transcribe them
  ],
  rateLimit: {
    requestsPerSecond: 100,
    requestsPerDay: 500000
  },
  rotation: {
    auto: true,
    intervalDays: 90,       // Rotate every 90 days
    gracePeriodHours: 24  // Old key valid for 24h after rotation
  }
});

console.log(key);
// {
//   id: "key_pq_abc123",
//   apiKey: "v100_sk_live_...",    // Shown once, never stored plaintext
//   scopes: ["transcript:read", "transcript:write", "recording:read"],
//   encryption: "kyber-aes256gcm",
//   verification: "ml-dsa-65",
//   rotationSchedule: "90d",
//   createdAt: "2026-03-28T14:00:00Z"
// }

// Manually rotate a key (zero downtime)
const rotated = await v100.apiKeys.rotate('key_pq_abc123');
// Old key valid for 24h grace period
// New key active immediately

// Check usage for a key
const usage = await v100.apiKeys.usage('key_pq_abc123');
// {
//   requests: { today: 12847, thisMonth: 387291 },
//   bandwidth: { today: "2.3 GB", thisMonth: "67.1 GB" },
//   lastUsed: "2026-03-28T15:42:00Z",
//   topEndpoints: ["/v1/transcripts", "/v1/recordings"]
// }

// Revoke a key (immediate propagation)
await v100.apiKeys.revoke('key_pq_abc123');
// Key is invalid on the NEXT request (31ns cache invalidation)

Or use the REST API:

terminal

# Create a scoped API key
curl -X POST https://api.v100.ai/v1/api-keys \
  -H "Authorization: Bearer YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Transcription Service",
    "scopes": ["transcript:read", "transcript:write", "recording:read"],
    "rateLimit": { "requestsPerSecond": 100 },
    "rotation": { "auto": true, "intervalDays": 90 }
  }'

# Rotate a key
curl -X POST https://api.v100.ai/v1/api-keys/key_pq_abc123/rotate \
  -H "Authorization: Bearer YOUR_ADMIN_KEY"

# Revoke a key (immediate)
curl -X DELETE https://api.v100.ai/v1/api-keys/key_pq_abc123 \
  -H "Authorization: Bearer YOUR_ADMIN_KEY"

Key Management Features

Enterprise-grade key management built into every V100 plan. No third-party key management service required.

Automatic Key Rotation

Schedule automatic key rotation at 30, 60, or 90-day intervals. New key is generated automatically, old key enters a configurable grace period (default 24 hours) where both keys are valid. Your systems update without downtime.

Usage Tracking

Per-key analytics showing requests per day, bandwidth consumed, top endpoints accessed, error rates, and last-used timestamps. Identify unused keys, detect anomalous usage patterns, and optimize your integration's API consumption.

Per-Key Rate Limiting

Set independent rate limits for each API key: requests per second, requests per day, and bandwidth caps. Prevents a single integration from consuming all of your quota. Rate limit state is tracked in the 31ns Cachee layer for zero-overhead enforcement.

Instant Revocation

Revoke a key and it is invalid on the next API request. Not eventually consistent -- immediately consistent. The Cachee layer propagates revocations across the entire gateway in a single operation. Critical for incident response when a key is compromised.

Audit Logging

Every key operation is logged: creation, rotation, revocation, scope changes, and failed authentication attempts. Audit logs are stored in append-only encrypted storage with Dilithium signatures for tamper detection. Meets HIPAA, SOC 2, and FINRA audit requirements.

Server-Side Proxy

V100's server-side proxy architecture ensures API keys never reach client devices. All API calls are routed through your backend, where the key is injected server-side. This eliminates the most common credential exposure vector: keys in client-side JavaScript, mobile app binaries, or browser network tabs.

API Key Security Comparison

Most API providers store keys as hashes with no post-quantum protection, no signature verification, and no sub-millisecond validation.

Feature	V100	Twilio	Daily	Agora
PQ key encryption	Kyber + AES-256	Hash only	Hash only	Hash only
Signature verification	Dilithium	HMAC	None	HMAC
Validation latency	31ns	~1ms	~1ms	~1ms
Granular scopes	14 scopes	Limited	No	No
Auto rotation	30/60/90d	Manual	Manual	Manual
Per-key rate limiting	Yes	Account-level	Account-level	Account-level

Quantum-Safe API Keys. 31 Nanosecond Validation.

Every V100 API key is Kyber-encrypted and Dilithium-verified from day one. Scoped permissions, auto-rotation, and per-key rate limiting included on all plans.

Get API Key — Free Tier Contact Sales

Related Resources

Feature

Quantum-Safe
API Authentication

Why API Key Security Matters

Key Theft is the #1 API Breach Vector

Database Breaches Expose Plaintext Keys

Rotation and Revocation are Critical

Cryptographic Architecture

Key Creation: Kyber + AES-256-GCM Envelope

Request Verification: Dilithium Signatures

Cache Validation: 31 Nanoseconds via Cachee

Scoped Permission System

Integration

Key Management Features

Automatic Key Rotation

Usage Tracking

Per-Key Rate Limiting

Instant Revocation

Audit Logging

Server-Side Proxy

API Key Security Comparison

Quantum-Safe API Keys. 31 Nanosecond Validation.

Related Resources

Post-Quantum Encryption

Zero-Knowledge Meetings

Post-Quantum Encrypted Meetings

Quantum-SafeAPI Authentication

Why API Key Security Matters

Key Theft is the #1 API Breach Vector

Database Breaches Expose Plaintext Keys

Rotation and Revocation are Critical

Cryptographic Architecture

Key Creation: Kyber + AES-256-GCM Envelope

Request Verification: Dilithium Signatures

Cache Validation: 31 Nanoseconds via Cachee

Scoped Permission System

Integration

Key Management Features

Automatic Key Rotation

Usage Tracking

Per-Key Rate Limiting

Instant Revocation

Audit Logging

Server-Side Proxy

API Key Security Comparison

Quantum-Safe API Keys. 31 Nanosecond Validation.

Related Resources

Post-Quantum Encryption

Zero-Knowledge Meetings

Post-Quantum Encrypted Meetings

Quantum-Safe
API Authentication