Auth / API keys
OpenRouter-style DX: mint in the app, send as Bearer on every ingest request. Spanport stores SHA-256 hashes only.
Key format
| Part | Value |
|---|---|
| Prefix | spc_live_ (production). spc_test_ reserved. |
| Secret | 24 random bytes, base64url |
| Display | First 16 characters (prefix) in the dashboard |
| Storage | SHA-256 hex of the full secret — never the raw key |
Headers
Any one of these works on POST /v1/traces:
Authorization: Bearer spc_live_…
x-spanport-api-key: spc_live_…
x-api-key: spc_live_…Environment variables
| Name | Who | Purpose |
|---|---|---|
SPANPORT_API_KEY | Customer app | Your Spanport ingest key |
OTEL_EXPORTER_OTLP_HEADERS | OTel SDK | Authorization=Bearer $SPANPORT_API_KEY |
SPANPORT_DEMO_API_KEY | Operators | Re-seed local demo key after gateway restart |
SPANPORT_EXPOSE_DEMO_KEY | Operators | Set 0 in production to hide demo plaintext from/v1/control/snapshot |
Lifecycle
- Create —
POST /v1/control/api-keys{ "projectId", "name" }. Response includesplaintextonce. - List — prefixes via
GET /v1/control/snapshot(no hashes, no secrets). - Revoke —
DELETE /v1/control/api-keys/:id. Soft revoke; auth fails immediately after cache refresh.
Prefer the dashboard for mint / revoke. Never log raw keys; gateway logs only the display prefix.