Get started

Projects, environments, and credentials

Model repositories and deployments, issue least-privilege runtime keys, rotate them, and archive unused identities.

Choose stable identifiers

Use one project ID per repository or cohesive application, one environment ID per deployment stage, and one service ID per independently deployed process. IDs should be lowercase and stable across deploys.

RepositoryProjectEnvironmentServices
Acme Incacmeproductionapi, worker
Astrea AIastrea-aistagingbackend

Provision a service

Resource creation is available through MCP. Tenant IDs are never accepted from tool input; the authenticated Clerk organization supplies the tenant boundary.

text
1. create_project(project_id="acme", display_name="Acme Inc")
2. create_environment(project_id="acme",
   environment_id="production", display_name="Production")
3. register_service(project_id="acme",
   service_id="api", display_name="API")
4. create_service_credential(project_id="acme",
   environment_id="production", service_id="api",
   label="API production July 2026")

Store the returned credential

The create response returns an lp_service_... API key exactly once. LiveProbe stores only its SHA-256 hash. Put the plaintext key in the target deployment's secret manager and expose it to the process as LIVEPROBE_API_KEY.

A credential is not a human API key

A service credential can only poll, ingest, and upload source maps for its exact organization, project, environment, and service. It cannot list other services or manage probes.

Rotate and revoke

  1. Create a second credential with a dated label.
  2. Update the deployment secret and roll out the application.
  3. Confirm the service is heartbeating with the new key.
  4. Use list_service_credentials to locate the old credential ID.
  5. Revoke the old credential.

Revocation takes effect on the next broker request. A revoked key receives HTTP 401 and cannot be recovered.

Archive unused resources

Archiving a service revokes its credentials across every environment. Archiving an environment or project revokes all affected active credentials. Diagnostic and audit history is retained, and recreating the same ID restores the catalog identity.