We just published a deep-dive on Vectreal API keys: how they're scoped, how requests are authorized, and the rotation patterns that match real deployment shapes

[Vectreal-Admin]

Three layers, not one shared secret:

• Organization scope (immutable, set at creation)
• Project scope (subset of projects within that org, also immutable)
• Domain allowlist (per-project, the second security layer)

On every authorized request, three checks happen:

• Token format (vctrl_ prefix, parses cleanly).
• Origin matches the project's allowed-domain patterns.
• The scene the request is for belongs to a project the key was scoped to.

Three rotation patterns covered:

• Single marketing site → one key, one origin, 90-day expiration, 60-day rotation cadence.
• Per-environment app → three keys (dev/staging/prod) with tighter expirations on dev.
• Per-tenant SaaS → one key per customer project; revocation is part of off-boarding.

All claims verified against the live implementation in apps/vectreal-platform/app/lib/domain/auth/. Code is open: https://github.com/Vectreal/vectreal-platform

Read the full post: Newsroom

Join our Discord: Invite