Credentials & Projects

# Credentials & Projects

A **Project** is an external consumer of Persona's infrastructure — your app, not a Persona user session.

- Create in Developer Studio → `Projects` → `New` — you become `Admin`.
- Each Project has **credentials**: `<keyId>.<secret>` shown once. This is the `PERSONA_CREDENTIAL` you set as `process.env.PERSONA_CREDENTIAL`.

```
Authorization: Bearer <keyId>.<secret>
```

## Lifecycle

`ACTIVE` → `SUSPENDED` (credentials stop authenticating; reversible) → `DELETING` (grace-period, cancellable) → `DELETED`.

- **Revoke** a credential — it stops immediately.
- **Suspend** a Project — all its credentials stop.
- **Admin surface** (members, credentials, suspend/restore) uses Clerk session auth — **not** the machine credential this SDK uses. Manage there: Developer Studio.

## Rules

- Never bundle the credential (see [SDK quickstart](/docs/sdk/v0.9.0/quickstart)). Server-side only.
- Rotate by minting a new credential, deploying it, then revoking the old one.
- Rate-limited mutations use `429 Retry-After` + `Idempotency-Key` header for safe retries.