Expected outcome
The integration has a narrow credential with an owner, an expiration, and a clear revocation path.
Tempera is in private preview and provides private APIs across its product areas. Access is arranged through onboarding for an agreed evaluation, with product-specific credentials, endpoints, and environment details supplied directly to your team. API maturity ranges from preview to research, and no shared cross-product endpoint is implied.
Before you start
- A provisioned workspace
- An integration that cannot complete the standard secure sign-in (OAuth) flow
- A secret manager for the resulting key
Steps
- 01
Confirm secure sign-in cannot be used
OAuth lets a person approve access without giving the client their password. Keep it as the preferred path for interactive clients, and use an API key only when the approved system cannot complete that flow.
- 02
Choose the narrowest permissions
Select only the workspace and actions needed for the job. Do not use an administrator permission as a shortcut.
- 03
Set an owner and expiration
Name the integration so the team can identify it later, then choose an expiration that matches the evaluation or deployment period.
- 04
Copy once and store safely
Move the key directly into the approved secret manager. Do not paste it into source control, tickets, prompts, or review notes.
What success looks like
- The key belongs to one named integration.
- Its permissions and expiration are visible to the workspace owner.
- The secret is stored outside source code and can be revoked independently.
If something is blocked
- If the key lacks an action, add only the missing permission after review.
- If the secret was exposed, revoke it and create a replacement immediately.
- If ownership is unclear, revoke the unused key rather than leaving an unowned credential active.