Api keys

Foveus API keys connect your services to your workspace. Your service uses an API key when sending executions, logs, context, metrics, and issue evidence to Foveus.

Key types

Foveus supports two key types:

Key type	Created by	Use for
Test key	Created automatically during onboarding	Local development, sandbox testing, QA, and private beta setup
Live key	Issued by the Foveus team (not self-serve during private beta)	Production telemetry

Test keys start with:

fov_test_...

Live keys start with:

fov_live_...

The prefix decides the mode: a fov_test_ key sends telemetry to Test mode and a fov_live_ key sends it to Live mode. There is no separate mode setting. Keys are shown once. Store the key when it is displayed.

Test keys

Your test key is created automatically during onboarding. Use it for:

local development
sandbox services
QA environments
staging validation
SDK setup

A test key sends telemetry to Test mode.

{
  "Foveus": {
    "ApiKey": "fov_test_..."
  }
}

During private beta there is no rotate or revoke control in the dashboard, for test or live keys.

Live keys

Live keys are not self-serve during private beta. Ask the Foveus team for a live key when you are ready to send production telemetry. A live key sends telemetry to Live mode.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "ServiceName": "orders-api",
    "Environment": "production"
  }
}

Treat live keys like production secrets. Do not expose them in source control, logs, screenshots, chat messages, issue trackers, or client-side applications.

Store keys safely

Do not hardcode API keys in production code. For local development, use .NET user secrets:

dotnet user-secrets set "Foveus:ApiKey" "fov_test_..."

For deployed services, use a secret manager or environment variable. Common options include:

Azure Key Vault
AWS Secrets Manager
Google Secret Manager
Kubernetes secrets
Docker secrets
Render environment variables

Use environment variables

Most .NET apps can read configuration from environment variables. For a nested configuration value like:

{
  "Foveus": {
    "ApiKey": "fov_live_..."
  }
}

you can set:

Foveus__ApiKey=fov_live_...

Then load configuration normally:

builder.Services.AddFoveus(builder.Configuration);

Do not expose keys to browsers

Foveus API keys are server-side secrets. Do not use them in:

frontend JavaScript
mobile apps
browser extensions
public repositories
static websites

Send telemetry from your backend services.

Keep test and live keys separate

Use test keys for non-production telemetry. Use live keys for production telemetry. Do not use a test key in production. Do not use a live key in local development.

Permissions

During private beta, Foveus API keys are created with permissions needed to ingest telemetry. A key allows telemetry ingestion for:

logs
metrics and execution telemetry
context
error reports

Replace a key

Replace a key if:

the key was exposed
a team member with access leaves
your security policy requires periodic rotation

During private beta there is no rotate or revoke control in the dashboard. Contact the Foveus team for a replacement key, then:

Update your service secret with the new key.
Redeploy or restart your service.
Confirm telemetry is arriving with the new key.
Ask the Foveus team to revoke the old key.

A service that still uses a revoked key keeps running, but its ingestion requests fail with HTTP 401.

If a key is exposed

If a key is exposed, contact the Foveus team immediately so the key can be revoked and replaced, then follow the steps above.

Logging safety

Never log your API key. Avoid logging full configuration objects if they include secrets. If an API key appears in logs:

Remove or mask the log.
Contact the Foveus team to replace the key.
Check whether the key was shared outside your team.

Foveus does not redact log messages, so a key written to a log that Foveus captures is stored as written.

Example production setup

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "ServiceName": "orders-api",
    "Environment": "production",
    "CaptureProfile": "Balanced"
  }
}

For deployed services, keep ApiKey in a secret manager and keep the remaining non-secret options in app configuration.

Troubleshooting

Telemetry does not appear

Check that:

the API key is correct
the startup log does not contain Foveus is disabled: — if it does, fix the reason it gives (Foveus.SDK 1.1.0-beta.18 or later; earlier versions throw at startup)
the key has not been revoked (ingestion fails with HTTP 401)
the key mode matches the dashboard mode
the service can reach Foveus
the SDK is loading the expected configuration
the service was restarted after changing the key

Telemetry appears in Test mode

The service is using a fov_test_ key. The key decides the mode, so a test key always sends to Test mode. If this is production telemetry, use a live key:

{
  "Foveus": {
    "ApiKey": "fov_live_..."
  }
}

A key was committed to source control

Remove the key from source control and contact the Foveus team to replace it. If the key appears in Git history, treat it as exposed.

Next steps

Create an API key: Create an API key
Configure the SDK: SDK configuration
Review data safety and retention: Data safety and retention
Configure redaction: Redaction

Start here

Get started

Core concepts

Guides

SDK

Security and data

API reference

Key types

Test keys

Live keys

Store keys safely

Use environment variables

Do not expose keys to browsers

Keep test and live keys separate

Permissions

Replace a key

If a key is exposed

Logging safety

Example production setup

Troubleshooting

Telemetry does not appear

Telemetry appears in Test mode

A key was committed to source control

Next steps