# Tripwire keys

> A decoy gateway key to plant where your secrets live. It serves nothing and answers like an unknown key; when it is presented, every member is told.

Source: https://infro.io/docs/security/tripwires

> **Warning:** **On the roadmap — not available yet.** Tripwire keys are built and in testing, and not deployed. This page describes what they will ship with.

A **tripwire key** is a gateway key that exists to be stolen. You plant it where your real secrets live (a host's environment variables, a vault, a CI variable, a private repository) and nothing ever uses it. If anyone presents it to INFRO, the place you planted it has leaked, and every member of the organization is told.

## How it behaves

- It has the exact format of a gateway key (`sk_infro_` and 43 characters), so it cannot be told from a real one by looking.
- It serves nothing. It is stored as revoked from the moment it is made, so no version of the gateway can accept it.
- Presented to any endpoint, it gets the same `401` an unknown key gets, byte for byte, and counts toward the same per-address limit on failed keys. Whoever holds it learns nothing.
- Each presentation is counted by UTC day and country. INFRO never records the caller's IP address or user agent.
- The first presentation of a UTC day raises a critical **Tripwire touched** [signal](https://infro.io/docs/security/signals), emailed to every member, and it cannot be muted. Later presentations that day update its counts and countries without another email.
- Tripwire keys are not gateway keys you can use: they are not on the Keys screen or in `GET /console/keys`, cannot be edited or rotated, and do not count toward anything.

## Plant one

1. Under **Security**, create a tripwire and name it after where you will put it ("Railway env, checkout service"). A project and an environment are optional; they only label it.
2. Copy the key. It is shown once.
3. Put it where a real key would be, under a name a real key would have, and never use it.

**Retire** a tripwire you removed: presenting it then records nothing, and it answers as an unknown key, as before.

## Who can manage them

Owners, admins and Security members create, list and retire tripwires. Every member is emailed when one is touched.

## API

**On the roadmap.** Tripwire keys are built and not deployed. Through the console session: `GET /console/security/tripwires` lists them, newest first, each with `id`, `label`, `display` (the masked key), `project_id`, `environment`, `created_at`, `retired_at`, `touches_30_days`, `countries_30_days` and `last_touched_at`. `POST /console/security/tripwires` with `{label, project_id?, environment?}` (a label of 1 to 80 characters) returns `201` with `tripwire` and `secret`, the only time the key is returned. `POST /console/security/tripwires/{id}/retire` returns `{id, retired: true}`. Each is in the [audit log](https://infro.io/docs/org/audit-log) as `tripwire_key.created` or `tripwire_key.retired`.