Keysmith

#What it is

Keysmith handles the full lifecycle of API keys: generation, hashing, storage, validation, rotation, revocation and usage analytics.

#The one rule

Raw keys are returned exactly once, at creation, and never persisted. Only SHA-256 hashes are stored. A database dump therefore contains no usable credentials, and there is no "show me the key again" API to be socially engineered.

This is not novel. It is worth stating because the alternative keeps reappearing in codebases whose authors know better, usually because a support workflow asked for it.

#What it does

• Create, validate, rotate, revoke, suspend and reactivate.
• Hierarchical permission scopes assigned per key.
• A policy engine covering rate limits, IP and origin allowlists, key lifetime constraints and quotas.
• Per-request usage recording with daily and monthly aggregation.
• Rotation with configurable grace windows, so both the old and new key validate during a cutover.
• Opt-in plugin hooks for audit trails, metrics and authorization sync.
• A Forge extension with DI, REST routes and automatic migration.

#Rotation, specifically

Zero-downtime rotation is the feature that determines whether anyone rotates at all. A grace window where both keys are valid means a customer can deploy the new key on their own schedule, and the old key expires on a date you both agreed rather than the moment someone clicked a button.