Data-plane credential lifecycle

Native data-plane services (*.data.codyhill.dev) enforce strict credential lifecycles: automated expiration, zero-downtime renewal, and active connection source auditing.

Credential summary

Service	Credential Type	Default Expiry	Renewal Workflow	Usage Auditing
MemoryStore	Instance Password	90 days	renew-credential (Overlap window, zero restart)	Active connections & IP origin tracking
Pub/Sub	Project Access Token	30 days	Request fresh credentials via API/CLI	Connected producer/consumer metrics
VectorDB	Project Access Token	30 days	Request fresh credentials via API/CLI	Per-request endpoint audit logs

---

1. Expiration enforcement

All data-plane credentials include an expires_at timestamp.

• Tokens (Pub/Sub & VectorDB): Expiration timestamps are embedded within cryptographically signed tokens. Expired tokens are rejected at the edge.
• Passwords (MemoryStore): Password expiry dates are reported in API responses and Console dashboards. Expired passwords can be renewed seamlessly without instance downtime.

---

2. Zero-downtime credential renewal

Renewing credentials prior to expiration prevents connection disruptions:

• Token Renewal (Pub/Sub & VectorDB): Request fresh credentials using platformctl pubsub credentials or platformctl vectordb credentials. Newly issued tokens work immediately alongside existing active tokens until expiration.
• MemoryStore Password Renewal: Use renew-credential to generate a new instance password while maintaining a 24-hour overlap window for existing connections.

platformctl

Renew a MemoryStore password:

platformctl memorystore renew-credential my-cache

Request fresh Pub/Sub credentials:

platformctl pubsub credentials

curl

# Renew MemoryStore password
curl -sX POST "$CAI_API/v1/projects/$CAI_PROJECT/memorystores/my-cache/renew-credential" \
  -H "Authorization: Bearer $CAI_TOKEN"

# Fetch Pub/Sub credentials
curl -s "$CAI_API/v1/projects/$CAI_PROJECT/pubsub/credentials" \
  -H "Authorization: Bearer $CAI_TOKEN"

Console UI

Navigate to your data service details page and click Renew Credential.

---

3. Usage & Source IP Auditing

Data service credential responses report last_used_at timestamps and source IP classifications:

• external: Traffic arriving from public internet addresses through the public gateway edge.
• internal: Traffic originating from workloads running inside your project private network.

Source IP tracking allows administrators to detect unauthorized connection attempts or unrecognized origin IPs across production credentials.