# Scope access to the actions an application needs

Canonical: https://savrn.com/cloud/keys

SAVRN Cloud · Coming soon. Public documentation and a browser simulation are available; connected services are not yet available.

A credential should grant a defined application access to a bounded set of actions. SAVRN Cloud’s public preview illustrates project key creation, scope selection and local revocation using values that cannot authenticate to a service. Connected API access, production credentials and supported SDKs are Coming soon.


## Start with the application’s responsibility

A client that reads records needs different authority from one that starts inference or evaluations. The preview presents sample scopes to make that distinction visible. Before a connected integration is enabled, its owner should identify which project it serves, which actions it requires and how its access will be reviewed when the application or team changes.

## Understand the preview credential lifecycle

Create a demo key to inspect its local record and simulated value, then revoke it to see the lifecycle change. The value is labeled as not a real key. It is not accepted by a live endpoint and is not used by the preview playground. Do not place production secrets or credentials into the demonstration.

## Plan for issuance, rotation and revocation

Connected credentials require secure issuance, appropriate storage, reliable revocation and an audit trail for administrative changes. Rotation needs a supported transition so applications can adopt new credentials without leaving old access active indefinitely. The service must check authorization where actions execute; hiding a control in the interface is not sufficient to enforce a key’s scope.

## Publish only a supported integration contract

Developers need a real base URL, versioned request and response schemas, error behavior, limits and tested examples before integrating. SAVRN Cloud’s documentation describes those prerequisites without inventing a working command or SDK installation. A future quickstart should identify supported authentication and capabilities precisely, including how a revoked credential behaves during ongoing or retried work.

## What you can explore today

Create and revoke local demo key records; their values do not authenticate to any service.

## Before this service launches

Live credentials require enforced scope checks, secure key handling, supported API contracts and verified revocation behavior.

## The customer outcome

The intended outcome is application access that can be attributed, constrained, rotated and withdrawn without losing the history of what was authorized.

## Related documentation

- [SDK and CLI compatibility](https://savrn.com/cloud/docs/developers-sdk-cli)
- [Public API publication](https://savrn.com/cloud/docs/reference-api)
- [Projects and access](https://savrn.com/cloud/docs/platform-projects-access)
- [Explore demo keys](https://savrn.com/cloud/console/#/keys): Inspect scoped sample credentials and local revocation.