feat: document ttl for api keys (#1899)

* feat: document ttl for api keys --------- Co-authored-by: Vincent <[email protected]> Co-authored-by: zepatrik <[email protected]>
ory · Oct 22, 2024 · eb17767 · eb17767
1 parent 23a66fa
commit eb17767
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 4 deletions.
diff --git a/docs/concepts/_static/api_keys/pak.png b/docs/concepts/_static/api_keys/pak.png
diff --git a/docs/concepts/_static/api_keys/wak.png b/docs/concepts/_static/api_keys/wak.png
diff --git a/docs/concepts/personal-access-token.mdx b/docs/concepts/personal-access-token.mdx
@@ -37,8 +37,14 @@ Follow these steps to create API Keys for your Project:
 
 1. Go to <ConsoleLink route="project.developers" />.
 2. Click **Create new API key**
-3. Enter the API Key name and click **Create**
-4. Copy the created API Key
+3. Enter the API Key name
+4. Select an **expiration** date.
+5. Click **Create**
+6. Copy the created API Key
+
+Finding the best expiration date for an API key is always a tradeoff between security and usability. Rotating keys is generally a
+good practice, however it comes at the cost of increased maintenance -- automatic or manual. If your API keys expire before you
+renew them, your service might degrade or become unavailable.
 
 ```mdx-code-block
 <BrowserWindow url="https://console.ory.sh/projects/current/developers">
@@ -97,8 +103,13 @@ Follow these steps to create API keys for your workspace:
 2. Go to **Workspace settings** through the workspace menu in the top left corner.
 3. Select **API keys** in the sidebar.
 4. Click the **+** icon in the **API Keys** section.
-5. Enter the API Key name and click **Create new API key**.
-6. Copy the created API Key from the prompt that shows at the bottom right of the screen.
+5. Enter the API Key name
+6. Select an **expiration** date.
+7. Click **Create** . Copy the created API Key from the prompt that shows at the bottom right of the screen.
+
+Finding the best expiration date for an API key is always a tradeoff between security and usability. Rotating keys is generally a
+good practice, however it comes at the cost of increased maintenance -- automatic or manual. If your API keys expire before you
+renew them, your service might degrade or become unavailable.
 
 ```mdx-code-block
 <BrowserWindow url="https://console.ory.sh/workspaces/current/settings/api-keys">