Applications and keys
An Echo application represents a consumer or producer in your workspace. It is not a person signing in to Maestro. Its eck_ keys let automation use specific Echo APIs without reusing a user's session.
Register the application
Open Applications in Maestro, create the application and add its contract bindings. Choose Consumes for an operation it calls or Provides for one it supplies, and select the agreed version. Application and key management requires workspace administrator access.
Give each key the permissions it needs
| Scope | Allows | Does not allow |
|---|---|---|
ReadBoundContracts |
Read consumed contracts bound to this application and their compatibility changes | Publish versions or read every workspace contract |
PublishOwnedContracts |
Publish versions of existing contracts with a Provides binding for this application |
Create contracts, take ownership or publish another application's contracts |
ServeMocks |
Fetch active mock rules shared through the workspace's teams | Fetch personal mocks, manage hosting or grant contract publication |
ServeMocks is not limited to this application's contract bindings. It reads shared mock rules in the workspace; it does not require those mocks to be publicly hosted. Use a separate key for a consumer's CI and a producer's publishing pipeline.
Issue and store a key
- Open the application's keys, create a key and select only the required scopes.
- Give it a description identifying its purpose and choose an expiry.
- Copy the full secret immediately. It is shown only once; later lists show its prefix and metadata.
- Store it in your CI secret store, environment or vault. Never commit it or put it in browser code, screenshots or URLs.
The package examples use environment variables. The packages send the key to the API, not to the public mock URL. A hosted mock's public identifier is a separate access mechanism.
Rotate and revoke
To rotate an application credential, create a replacement, update the consuming process, verify it and revoke the old key. Revoke a lost or exposed key from the application's key list; generate a new one instead of trying to recover its secret.
Revocation prevents future authenticated API access. It does not erase rules already cached by Mock.Client or Mock.Server: failed refreshes retain the last snapshot. If you need that process to stop mocking immediately, disarm or stop it and handle its cache explicitly.
To disable a public hosted URL or replace its identifier, use the hosting panel described in remote mocks. Revoking an eck_ key does not disable that URL.