Skip to main content

API Key Request Procedure

Applies to: Requesting an API key or access token for Axiom or Langfuse Where it happens: Slack → Linear Who this is for: Any Legion Security team member who needs a scoped credential for one of these tools

1. Submit the Request​

  1. In Slack, run /linear, select Create New Issue, and then select the API Key Request template.
  2. Select the Administration team, if it isn't already the default.
  3. Fill in the form fields:
    • Tool — Axiom or Langfuse
    • Project / Region — the specific project, dataset, or region the key needs access to
    • Purpose — a short justification (what it's for, not just "need access")
    • Needed until — if the key is temporary; this sets the issue's due date and drives automatic expiration
  4. Submit.

That's the entire requester-side action — no follow-up ticket routing, no manual pinging, and no special posting ritual required. Plain /linear is all you need; how you'll hear back is handled automatically regardless of how the issue was created (see Section 3).

2. What Happens After You Submit​

  • The issue is created in the Administration team, tagged with the API Key Request label (plus an Axiom or Langfuse sub-label). It is not filed under a separate project — the label is what drives routing.
  • A saved Linear view scoped to that label automatically pushes a notification into the private #api-key-requests Slack channel, visible only to the fulfilling admins.
  • No manual triage step happens on your end — the right people are notified the moment you submit.

3. Receiving Your Key​

  • An admin will provision the key directly in Axiom or Langfuse, scoped to what you requested.
  • The credential itself is delivered via 1Password — it will not be pasted into the Slack channel or the Linear issue comments. Only metadata (key ID, issuance date) is recorded there.
  • You'll get a Slack DM automatically the moment the admin marks the issue Done — no polling the issue, no asking around. The message includes what you requested (tool, project/region, purpose) and a direct link back to the issue.
  • If the request is declined or canceled instead, you'll get a different DM saying so, with a link to the issue for details on why.
  • If you haven't heard either way and it's time-sensitive, comment directly on the Linear issue (the link is in your original confirmation) rather than opening a duplicate request.

For Fulfilling Admins: Sharing the Credential via 1Password​

  1. Open 1Password in your browser or app and select the credential you want to share.
  2. Click the Share button (or the ellipsis menu and choose Share).
  3. Under recipient settings, select Only some people instead of anyone with the link.
  4. Enter your team member's specific email address.
  5. Set an expiration timeframe (from 1 hour up to 30 days).
  6. Copy the generated link and send it directly to your colleague.

4. Expiration & Renewal​

  • If you gave a Needed until date, expect the key to be revoked on or around that date — this is by design, not an error.
  • If you still need access beyond that date, submit a new request (or comment on the existing issue) before it expires. Don't wait until after expiration to ask for an extension — that creates a gap in access and a messier audit trail.
  • If your need was open-ended and you left Needed until blank, the key won't be auto-revoked — but it's still good practice to close the loop with the fulfilling admin once you no longer need it.

Quick Reference​

StepWho does it
Run /linear, fill in template, submitYou (requester)
Routing to #api-key-requests (admin channel)Automatic (Linear)
Provision the keyFulfilling admin
Deliver credential securely via 1PasswordFulfilling admin
Mark issue Done or Canceled → auto-DM to youAutomatic, triggered by admin's status change
Revoke at expirationFulfilling admin
Request renewal before expiryYou (requester)