Least Privilege for SDK Ingest Keys (And Why Eval Keys Exist)

The Bearer token on POST /api/v1/probes can write threads into your workspace. Treat aethel_live_ keys like database URLs. Put them in CI secrets, not in public README gists, not in the marketing site as copy-paste live credentials.

Ingest uses a security-definer RPC. Unknown keys fail closed. Monthly probe limits are enforced in the database, not only in a UI badge.

Sales bake-offs burn quota. The wrong answer is to upgrade the whole org to Growth so a prospect can spam probes for two weeks. Eval-mode keys are time-boxed bonuses: extra probes, an expiry, a prospect email, and a revoke switch.

When the key expires or hits its bonus, ingest stops. Your production plan is unchanged. That is least privilege for GTM, not a second production environment you forgot to turn off.

If a key leaks in a conference demo, rotate it in the dashboard and update the CLI wrap. Old probes stay in the inbox; new ingest needs the new secret. Combine that with Watch rules so a stolen key that suddenly spikes JWT errors still emails on-call.