From a governance perspective, we are required to rotate API credentials every 90 days per our information security policy. It is worth noting that we currently have seven production integrations consuming the FieldPulse API, including our customer portal, billing reconciliation service, and two vendor data feeds.
I have confirmed that the API key management interface supports only a single active key per account. When generating a new key, the previous key is immediately invalidated. This presents a significant operational risk: any credential rotation will result in service interruption until all seven integration points are updated and redeployed.
I am seeking clarification on the following points:
- Does FieldPulse support multiple concurrent API keys, or is there a mechanism to stage a new key before invalidating the existing one?
- If not, what is the recommended approach for credential rotation in high-availability environments?
- Are there plans to implement scoped API keys with independent lifecycle management?
Our current workaround involves scheduling rotation during a maintenance window, but this does not satisfy our continuous availability requirements. I would appreciate any guidance on how other organizations have addressed this constraint.
