Hello Typesense community, I have some questions about the ScopedSearchKey: 1. So in our case we want to generate a scoped search api key per user and per user role, so we were treating it as an ephemeral key. But it turns out not the case - the key is actually stored/registered with Typesense cluster. In this case we should just rotate the keys and not treat them as ephemeral right? 2. To rotate the key, we think we should just set

expires_at

and

autodelete

for each generated key, and let the cluster purge any expired keys. However, from the JS/TS client, I don't see

autodelete

param is exposed as stated in the API doc, is that expected? If so, how can we set ScopedSearch key to be autodelete after expired?

Scoped API keys are not stored on the server-side they are indeed ephemeral. You want to generate a parent API key (which is stored on the server side), and then re-use that same parent API key to generate multiple scoped API Keys. Or if you have the concept of teams or organizations, may be create one parent api key for each team or organization, and then use that same one to generate ephemeral scoped API keys for each user on that team who needs different scoped access.

@Jason Bosco Gotcha, yep that makes sense, thanks for the explanation! We will manage the parent API key as you suggested!