API keys

1Find them

API keys in the sidebar lists every project. The public key is always shown. The secret key is shown once when created and stored hashed: 'Copy it now; it is stored hashed and cannot be shown again.'

2Rotate the secret key

Create a new secret key stops the old one working straight away, so update Odoo or your pipeline right after. Owners and admins only; the rotation is written to the audit log.

3Instance binding

When Odoo connects, the key is bound to a fingerprint of that database and every request from it carries X-Blipit-Instance. A request with the same key from another database, or a request with the wrong instance header, gets 403 'this key is bound to a different instance'. One project holds one instance, so a restored copy needs its own project and key.

4Remove a project

Remove this project on the project page deletes its events, logs, spans, issues, keys, source maps and instance bindings, permanently. Its monitors and status pages belong to the workspace and are not touched.

Good to know

• A Sentry DSN is just the public key and project id: https://<public key>@in.blipit.io/<project id>. The Sentry SDK tab on the project's Keys page shows it filled in.
• Sixty unknown keys from one address in a minute block that address for a minute; known keys keep working.