Pause API keys, by hand or when their spend jumps
Pause a key on the API Keys page, or with POST /v1/keys/{id}/pause: its requests get 401 until you resume it, and its secret, Directives and budgets are kept. Turn on Pause keys on unusual spend in Directives and a key whose last hour cost at least $1 and five times its usual is paused for you, so a leaked or runaway key stops within the hour instead of when someone reads the email.
Unusual spend is now checked per key as well as per team, with each key measured against its own week, including the keys it was rotated from. The unusual spend email and the spend.anomaly webhook name the keys behind it and say which were paused. The setting is off by default and can be set at any level; the most specific one decides.
Two new webhook events: key.paused, for every pause, and key.compromised, for a key found in a public place. Inference Bureau is joining GitHub's secret scanning partner program, so that a key GitHub finds in a public repository is paused (a management key is revoked) and the team is emailed with where it was found.
More in Pausing a key.