Skip to content

docs(openapi): add APP Key exposure response steps #1051

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alick-liming wants to merge 1 commit into from
Closed

docs(openapi): add APP Key exposure response steps #1051

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions en/openapi/introduction.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,26 @@ An APP Key's effective access is constrained by both its permission scope and th

You can edit an existing APP Key's name and permission scope from the APP Key list.

### What to do if an APP Key is exposed

If you believe an APP Key has been exposed (for example, accidentally committed to a public code repository, or visible in logs or screenshots), act immediately:

<Steps>
<Step title="Create a replacement key">
Sign in to the [Flashduty Console](https://console.flashcat.cloud), go to **My → APP Key**, and create a new APP Key.
</Step>
<Step title="Switch your integrations">
Update every integration, script, and configuration that uses the old key to the new one, and confirm they work.
</Step>
<Step title="Delete or disable the exposed key">
Delete or disable the exposed key from the APP Key list so it stops working immediately and can no longer be abused.
</Step>
</Steps>

<Note>
If you receive a key-exposure notification email from Flashduty, your key was found in a public channel (such as a public GitHub repository). The email includes the exposure location — follow the steps above to rotate the key as soon as possible.
</Note>

### Usage example

Pass the APP Key as a query string parameter:
Expand Down
20 changes: 20 additions & 0 deletions zh/openapi/introduction.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,26 @@ APP Key 的实际可访问范围同时受其权限范围和创建者当前角色

您可以在 APP Key 列表中编辑已有密钥的名称和权限范围。

### APP Key 泄露了怎么办

如果你怀疑某个 APP Key 已经泄露（例如被误提交到公开代码仓库、出现在日志或截图中），请立即按以下步骤处置：

<Steps>
<Step title="创建替代密钥">
登录 [Flashduty 控制台](https://console.flashcat.cloud)，进入 **我的 → APP Key**，创建一个新的 APP Key
</Step>
<Step title="切换集成">
将所有使用旧 Key 的集成、脚本和配置切换到新 Key，并确认工作正常
</Step>
<Step title="删除或禁用旧 Key">
在 APP Key 列表中删除或禁用已泄露的旧 Key，使其立即失效，避免被继续利用
</Step>
</Steps>

<Note>
如果你收到 Flashduty 发送的密钥泄露通知邮件，说明你的 Key 在公开渠道（如 GitHub 公开仓库）被发现，邮件中会给出泄露位置，请按上述步骤尽快轮换。
</Note>

### 使用示例

将 APP Key 作为 query string 参数传入：
Expand Down