Applications and keys
An Echo application represents a consumer or producer in your workspace. It is not a person signing in to Maestro. Its eck_ keys let automation use specific Echo APIs without reusing a user's session.
Register the application
Open Applications in Maestro, create the application and add its contract bindings. Choose Consumes for an operation it calls or Provides for one it supplies, and select the agreed version. Creating an application, changing its bindings and issuing keys require a paid Echo plan with Echo/ManageHosting. The organization administrator receives this permission by default on a paid plan and can grant it to another role.
Give each key the permissions it needs
| Scope | Allows | Does not allow |
|---|---|---|
ReadBoundContracts |
Read consumed contracts bound to this application and their compatibility changes | Publish versions or read every workspace contract |
PublishOwnedContracts |
Publish versions of existing contracts with a Provides binding for this application |
Create contracts, take ownership or publish another application's contracts |
ServeMocks |
Fetch active mock rules shared through the workspace's teams | Fetch personal mocks, manage hosting or grant contract publication |
ServeMocks is not limited to this application's contract bindings. It reads team-shared mock rules in the workspace, even when those mocks have no public hosted URL; it never reads personal mocks. Access to the rule feed still needs paid public hosting on the organization. Use a separate key for a consumer's CI and a producer's publishing pipeline.
Issue and store a key
- Open the application's keys, create a key and select only the required scopes.
- Give it a description identifying its purpose and choose an expiry.
- Copy the full secret immediately. It is shown only once; later lists show its prefix and metadata.
- Store it in your CI secret store, environment or vault. Never commit it or put it in browser code, screenshots or URLs.
The package examples use environment variables. The packages send the key to the API, not to the public mock URL. A public mock's identifier is a separate access mechanism.
Rotate and revoke
To rotate an application credential, create a replacement, update the consuming process, verify it and revoke the old key. Revoke a lost or exposed key from the application's key list; generate a new one instead of trying to recover its secret.
Even if the organization no longer has a paid Echo plan, you can open Applications in Maestro directly, list its existing keys and revoke an exposed key. Listing and revocation require only Echo/MockServers; you do not need to buy hosting again to close a credential. Issuing its replacement requires the paid plan and Echo/ManageHosting.
Revocation prevents future authenticated API access. It does not erase rules already cached by Mock.Client or Mock.Server: failed refreshes retain the last snapshot. If you need that process to stop mocking immediately, disarm or stop it and handle its cache explicitly.
To disable a public hosted URL or replace its identifier, use the panel described in public mock hosting. Revoking an eck_ key does not disable that URL.