Credentials: API Key and Token Expiry Tracking
Nothing in your system signals that a key expires tomorrow. This is an inventory with date maths and escalating reminders, not a monitor.
Credentials tracks the expiry dates of API keys, OAuth tokens, signing secrets, service-account credentials and licence keys, and tells you before any of them lapse.
There is no ingest endpoint here and that is deliberate. A credential that expires tomorrow behaves identically to one expiring in three years, so there is no runtime signal to observe. This is an inventory problem with date arithmetic attached, and pretending otherwise would be dishonest design.
Three reminder zones, with one that repeats
A single warning is not enough, because the warning arrives when you are busy with something else and then never comes back. The zones escalate as the date approaches, and the innermost one does not give up.
| Days until expiry | Zone | Severity | Frequency |
|---|---|---|---|
| 16 to 30 | Warning | warning | Fires once |
| 6 to 15 | Critical | critical | Fires once |
| 5 or fewer, including already expired | Critical | critical | Daily until resolved |
The daily repeat in the final zone is the design decision that matters. An earlier fixed-threshold model fired at 30, 14, 7 and 1 days and then stopped, which meant a credential could expire quietly after its last reminder had been dismissed.
Zone state is tracked per credential rather than as a single threshold column, so moving into a new zone always fires even if the previous zone's reminder was acknowledged.
Rotation resets the cycle
When you change a credential's expiry date, the reminder state clears and any open alert resolves. The cycle starts again from the new date.
That means rotating a key and updating its date in one action leaves you with a clean slate rather than a stale alert you have to dismiss manually. It also means the record reflects the credential you actually hold, which is the point of keeping it.
What to record, beyond the date
An expiry date with nobody's name on it is a scheduled incident with no assignee. The fields worth filling in every time are what the credential is for, who renews it, and what breaks if it lapses.
That last field turns an alert into a prioritisation. A lapsed analytics key and a lapsed payment key produce identical warnings and very different mornings.
Plan limits
| Free | Starter | Team | Enterprise | |
|---|---|---|---|---|
| Credentials tracked | 2 | 15 | Unlimited | Unlimited |
| Reminder zones | All three | All three | All three | All three |
| Daily critical reminders | Yes | Yes | Yes | Yes |
The reminder behaviour is identical on every tier including Free. Expiry tracking is the cheapest thing we run and gating it would be artificial.
Honest limitation: entry is manual
SensaCat does not auto-discover credentials. There is no sync from HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or GitHub, so a credential nobody remembers to add is a credential nobody is watching.
If credential lifecycle is your only problem and you need automatic discovery across cloud providers, a dedicated tool will serve you better and we say so on our TokenTimer comparison. SensaCat is the right choice when credentials are one of several failure types you want in one account.
Background: credential expiry monitoring. Start free.