7.3Project keys
How the desktop app and the API authenticate, why keys are locked to a device, and how to rotate one.
Section 3 of 5 in this chapter
A project key authenticates a client — the desktop app, a script, a build agent — against exactly one project. Keys are prefixed usc_, shown once at creation, and stored by us only as a hash, so a leaked database does not leak anyone's key.
Device locking
The first machine to use a key claims it, and the key stops working anywhere else. This is checked on every request, not just at sign-in.
The practical consequence is that a key pasted into a chat message, committed to a public repository, or read off a screen in a stream is useless to whoever finds it — it is already bound to a machine that is not theirs.
Each seat gets one active key per project on Free and two on Team, so one person can work from a desktop and a laptop.