2.7.1
Security
Restricted keys and rotation without downtime
Create keys limited to some endpoints, and roll a secret key while the old one keeps working for 24 hours.
Secret keys can now be restricted to a list of scopes, such as payrolls:read or employees:write. A support tool that only reads pay runs no longer needs a key that can create them.
Rolling a key issues a new secret and keeps the old one valid for 24 hours, so you can deploy without a single failed request. Every key shows when and from which IP range it was last used, and keys left unused for 90 days are flagged in the dashboard.