Most Synorb traffic today doesn't come from a person typing a URL. It comes from an agent — a coding assistant, a research agent, a horizontal orchestrator — holding a Synorb Key and calling REST or MCP on someone's behalf. When a credential is the thing an agent has to get right before it can do anything else, the credential model has to be simple enough that getting it right is the default.
It wasn't. The dashboard let anyone generate as many Synorb Keys as they wanted, with no limit and no clear signal about which one was actually live. An agent configured against an old key kept "working" in the sense that it held a string that looked like a credential, until a call failed for reasons that weren't obvious from the response.
One key, not a pile of them
Every account now has exactly one active Synorb Key at a time. Generating a new key revokes whichever key was active first, in the same request — a single "Revoke & Issue" action rather than a separate create-then-forget-to-clean-up step. There's nothing left over to lose track of, and nothing ambiguous about which key an agent should be holding: it's whichever one the dashboard currently shows as active.
The same key, whichever surface an agent uses
A Synorb Key authenticates REST and MCP identically. An agent doesn't need a separate MCP token lifecycle from its REST credential, and moving a workflow from one surface to the other doesn't mean provisioning anything new. One secret, one place to look for it, one place to rotate it.
A visible trail instead of a guess
Every key an account has ever issued still shows up in the Credentials panel, now labeled ACTIVE or REVOKED with the exact time it changed state. If an agent's connection starts failing, the first thing to check is whether the key it's using shows up as REVOKED — and now that's a direct answer instead of a guess.
Rotating a key is deliberate, on purpose
Because issuing a new key immediately revokes the old one, rotating now asks for a typed confirmation that matches the stakes, instead of a browser popup that's easy to click through without reading. It costs five extra seconds and means nobody breaks a live agent integration by mis-clicking.
The Credentials panel also now shows manifest usage and days to reset alongside the key itself, so the two things that actually determine whether an agent's next call will work — which key is live, and how much quota is left — live in the same place.
None of this changes how an agent authenticates today. It changes how much anyone has to think about it. Read the agent and API documentation or start building with Synorb.