Tripwire keys

A tripwire key is a gateway key that exists to be stolen. You plant it where your real secrets live (a host's environment variables, a vault, a CI variable, a private repository) and nothing ever uses it. If anyone presents it to INFRO, the place you planted it has leaked, and every member of the organization is told.

How it behaves

• It has the exact format of a gateway key (sk_infro_ and 43 characters), so it cannot be told from a real one by looking.
• It serves nothing. It is stored as revoked from the moment it is made, so no version of the gateway can accept it.
• Presented to any endpoint, it gets the same 401 an unknown key gets, byte for byte, and counts toward the same per-address limit on failed keys. Whoever holds it learns nothing.
• Each presentation is counted by UTC day and country. INFRO never records the caller's IP address or user agent.
• The first presentation of a UTC day raises a critical Tripwire touched signal, emailed to every member, and it cannot be muted. Later presentations that day update its counts and countries without another email.
• Tripwire keys are not gateway keys you can use: they are not on the Keys screen or in GET /console/keys, cannot be edited or rotated, and do not count toward anything.

Plant one

1. Under Security, create a tripwire and name it after where you will put it ("Railway env, checkout service"). A project and an environment are optional; they only label it.
2. Copy the key. It is shown once.
3. Put it where a real key would be, under a name a real key would have, and never use it.

Retire a tripwire you removed: presenting it then records nothing, and it answers as an unknown key, as before.

Who can manage them

Owners, admins and Security members create, list and retire tripwires. Every member is emailed when one is touched.

API

On the roadmap. Tripwire keys are built and not deployed. Through the console session: GET /console/security/tripwires lists them, newest first, each with id, label, display (the masked key), project_id, environment, created_at, retired_at, touches_30_days, countries_30_days and last_touched_at. POST /console/security/tripwires with {label, project_id?, environment?} (a label of 1 to 80 characters) returns 201 with tripwire and secret, the only time the key is returned. POST /console/security/tripwires/{id}/retire returns {id, retired: true}. Each is in the audit log as tripwire_key.created or tripwire_key.retired.