Persona Environment and Least-Privilege API Key Setup

Overview

Establish an explicit environment boundary before any identity workflow. Persona API keys are environment-specific, may carry different configured API versions, and must reach https://api.withpersona.com/api/v1; a credential check must not create or mutate an inquiry.

Prerequisites

• Persona Dashboard access authorized for the target environment
• A named service owner, secret store, and rotation window
• The approved dated Persona API version; current documentation shows 2025-12-08

Instructions

Step 1: Inventory the boundary

Record sandbox or production, owning service, inquiry template, API-key permissions, configured API version, and secret-store location. Never infer environment from an untrusted request.

Step 2: Create and store the key