Credentials and keys

This page explains the two credential formats Monaiq gives you, where to get them, and what happens when you rotate.

The two formats

The API key is the secret that authenticates you to the Monaiq APIs.

The encoded credential is a single portable string that starts SIDUB_LIC_. It bundles the license id, the service key id, the service key public member and the API key into one value, so you configure one setting instead of four. Both SDKs take it directly, and it is the format the quickstarts use.

The Node client also accepts the four parts individually, as apiKey, licenseId, serviceKeyId and serviceKeyPublicMember, for cases where your configuration already holds them separately.

Where to get them

Go to monaiq.com/manage/credentials. The page shows “Your API key”, and mints one for you the first time you visit, so there is no separate create step.

If you work through an assistant, the profile tool retrieves your credentials as well. See AI-assisted setup.

Caution

Credentials are only ever shown inside your signed-in account. Monaiq never sends a key by email. Our emails link to the Credentials page; they never contain the key itself, so treat any message that does contain one as suspect.

Putting one into a project

Read the value from configuration rather than writing it into a file that is checked in.

• .NET. Set LicensingServiceOptions.EncodedCredential from a configuration key. The .NET quickstart reads it from Licensing:EncodedCredential, so you can supply the real value from user secrets while you develop and from the host’s configuration in production without the code changing.
• Node. Pass encodedCredential from the environment. The Node and React quickstart reads MONAIQ_CREDENTIAL.

If you would rather not do the plumbing yourself, the provision_api_key_config tool returns the exact commands and file edits for your project.

Rotating

Rotate from the Credentials page in the portal, or with the rotate_api_key tool from an assistant or any MCP client.

Caution

The old key stops authenticating immediately. There is no overlap window and no grace period, so anything still holding the old value starts failing the moment you rotate.

Because of that, rotate deliberately:

1. Know which deployments, environments and machines hold the current value.
2. Rotate.
3. Update every one of them with the new value.

For a single application that reads from one secret store this is quick. For several environments, plan the order before you press the button rather than after.

Rotate when a key may have been exposed, when someone who had access to it leaves, or on whatever schedule your own policy sets.

If you bought a product rather than built one

Credentials for something you bought are on the license detail page in your account, alongside its features and billing plan. See Your licenses.