FUNDAMENTALS2026-09-05 · 2 min

Issue and revoke a Service Credential for an environment

Cláudio C.

Engineering, rollfuse

@rollfuse/sdk-js authenticates with a bearer token tied to one environment. This tutorial issues that token, uses it to start a RollfuseClient, and then revokes it.

Issue a Service Credential

Call POST /v1/environments/{environment_id}/credentials with the environment you want the credential scoped to:

curl -X POST \
  "https://api.rollfuse.com/v1/environments/env_9f3ab2/credentials" \
  -H "Authorization: Bearer $ROLLFUSE_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "checkout-service-production"}'

The response includes the bearer token for the new credential. This token is shown once: store it right away, since the platform does not display it again after this call returns.

{
  "id": "cred_4k2n1p",
  "environmentId": "env_9f3ab2",
  "name": "checkout-service-production",
  "token": "rfcred_live_8f2a...",
  "createdAt": "2026-09-05T14:03:00Z"
}

Use the token in a client

Put the token in an environment variable, never in source control, and read it into RollfuseClient's credential option:

import { RollfuseClient } from "@rollfuse/sdk-js";

const client = new RollfuseClient({
  baseUrl: "https://api.rollfuse.com",
  credential: process.env.ROLLFUSE_CREDENTIAL!, // e.g. rfcred_live_8f2a...
});

await client.start();

If credential is missing or empty, the constructor throws CredentialRequiredError before any network call is made, so a misconfigured deploy fails immediately instead of silently serving fallback values.

Keep one credential per environment and per service

Issue a separate credential for each environment (staging, production) and, within a shared environment, a separate one per service that talks to the platform. That way one leaked token only exposes one service's read access to one environment's Configuration, and revoking it does not take down anything else.

Revoke a credential

When a service is decommissioned, or a token leaks, revoke it immediately with POST /v1/credentials/{credential_id}/revoke:

curl -X POST \
  "https://api.rollfuse.com/v1/credentials/cred_4k2n1p/revoke" \
  -H "Authorization: Bearer $ROLLFUSE_ADMIN_TOKEN"

Any RollfuseClient still running with a revoked credential keeps serving its last cached Configuration, but the next background poll to GET /v1/config fails, so onConfigRefreshError fires and the client stops receiving updates until it is restarted with a valid credential.

Rotate without downtime

To rotate a credential without an evaluation gap, issue the replacement first, deploy the service with the new ROLLFUSE_CREDENTIAL, confirm it starts and evaluates correctly, and only then revoke the old credential.

For choosing which SDK package needs this kind of credential in the first place, see Choose the right rollfuse SDK for the job.

credentialsenvironmentssecurity