Most Synorb traffic today doesn't come from a person typing a URL. It comes from an agent — a coding assistant, a research agent, a horizontal orchestrator — holding a credential and calling Synorb on someone's behalf. When a credential is the thing an agent has to get right before it can do anything else, the credential model has to be simple enough that getting it right is the default.
Ours wasn't. REST wanted an API key and a secret. MCP wanted a different token entirely. Two credential types for two access points to the same graph, and the dashboard let anyone generate as many of either as they wanted, with no clear signal about which one was actually live. An agent configured against an old key kept "working" in the sense that it held a string that looked like a credential, until a call failed for reasons that weren't obvious from the response.
One key, every access point
There's just one Synorb Key now. It authenticates REST and MCP identically — the exact same credential, checked against the exact same record — and it's also what authorizes your S3 export requests. An agent doesn't provision a separate MCP token or manage a key-and-secret pair for REST. It holds one string and uses it everywhere it talks to Synorb.
One key, not a pile of them
Every account now has exactly one active Synorb Key at a time, too. Generating a new key revokes whichever key was active first, in the same request — a single "Revoke & Issue" action rather than a separate create-then-forget-to-clean-up step. There's nothing left over to lose track of, and nothing ambiguous about which key an agent should be holding: it's whichever one the dashboard currently shows as active.
A visible trail instead of a guess
Every key an account has ever issued still shows up in the Credentials panel, now labeled ACTIVE or REVOKED with the exact time it changed state. If an agent's connection starts failing, the first thing to check is whether the key it's using shows up as REVOKED — and now that's a direct answer instead of a guess.
Rotating a key is deliberate, on purpose
Because issuing a new key immediately revokes the old one, rotating now asks for a typed confirmation that matches the stakes, instead of a browser popup that's easy to click through without reading. It costs five extra seconds and means nobody breaks a live agent integration by mis-clicking.
The Credentials panel also now shows manifest usage and days to reset alongside the key itself, so the two things that actually determine whether an agent's next call will work — which key is live, and how much quota is left — live in the same place.
One credential, one place to manage it, wherever your agent connects. Read the agent and API documentation or start building with Synorb.