From 8a844d32609866f37138802b06954addb282d5cb Mon Sep 17 00:00:00 2001 From: alick-liming Date: Wed, 14 Oct 2026 09:38:17 +0800 Subject: [PATCH] docs(openapi): add APP Key exposure response steps --- en/openapi/introduction.mdx | 20 ++++++++++++++++++++ zh/openapi/introduction.mdx | 20 ++++++++++++++++++++ 2 files changed, 40 insertions(+) diff --git a/en/openapi/introduction.mdx b/en/openapi/introduction.mdx index 18768f9de..fca4189a3 100644 --- a/en/openapi/introduction.mdx +++ b/en/openapi/introduction.mdx @@ -65,6 +65,26 @@ An APP Key's effective access is constrained by both its permission scope and th You can edit an existing APP Key's name and permission scope from the APP Key list. +### What to do if an APP Key is exposed + +If you believe an APP Key has been exposed (for example, accidentally committed to a public code repository, or visible in logs or screenshots), act immediately: + + + + Sign in to the [Flashduty Console](https://console.flashcat.cloud), go to **My → APP Key**, and create a new APP Key. + + + Update every integration, script, and configuration that uses the old key to the new one, and confirm they work. + + + Delete or disable the exposed key from the APP Key list so it stops working immediately and can no longer be abused. + + + + +If you receive a key-exposure notification email from Flashduty, your key was found in a public channel (such as a public GitHub repository). The email includes the exposure location — follow the steps above to rotate the key as soon as possible. + + ### Usage example Pass the APP Key as a query string parameter: diff --git a/zh/openapi/introduction.mdx b/zh/openapi/introduction.mdx index 9998035fe..3b610f786 100644 --- a/zh/openapi/introduction.mdx +++ b/zh/openapi/introduction.mdx @@ -66,6 +66,26 @@ APP Key 的实际可访问范围同时受其权限范围和创建者当前角色 您可以在 APP Key 列表中编辑已有密钥的名称和权限范围。 +### APP Key 泄露了怎么办 + +如果你怀疑某个 APP Key 已经泄露（例如被误提交到公开代码仓库、出现在日志或截图中），请立即按以下步骤处置： + + + + 登录 [Flashduty 控制台](https://console.flashcat.cloud)，进入 **我的 → APP Key**，创建一个新的 APP Key + + + 将所有使用旧 Key 的集成、脚本和配置切换到新 Key，并确认工作正常 + + + 在 APP Key 列表中删除或禁用已泄露的旧 Key，使其立即失效，避免被继续利用 + + + + +如果你收到 Flashduty 发送的密钥泄露通知邮件，说明你的 Key 在公开渠道（如 GitHub 公开仓库）被发现，邮件中会给出泄露位置，请按上述步骤尽快轮换。 + + ### 使用示例 将 APP Key 作为 query string 参数传入：