Guide
Credential Rotation and Revocation
Recover from lost, exposed, rotated, revoked, or stale product plugin credentials without asking customers for embedded secrets.
SoundSync
Troubleshooting matrix
Use platform status and credential previews before changing customer activation state.
| Symptom | Likely cause | Corrective action | Code/status |
|---|---|---|---|
| Test Connection returns INVALID_APP_ID | Package has stale or wrong ss_prod App ID. | Copy the current App ID from the product credential panel and regenerate the package. | INVALID_APP_ID |
| Test Connection returns INVALID_PLUGIN_KEY | Plugin key preview does not match current active credential. | Rotate-key only if the current key is lost or exposed; otherwise update the package config. | INVALID_PLUGIN_KEY |
| Test Connection returns INVALID_PLUGIN_SECRET | Plugin secret is stale, missing, or from another product. | Reveal recoverable secret or rotate-secret, then regenerate the package. | INVALID_PLUGIN_SECRET |
| Credential reveal fails | Older credential has no recoverable encrypted secret. | Use rotate-secret or rotate-key recovery endpoints returned by the API. | PRODUCT_CREDENTIAL_SECRET_UNAVAILABLE |
| Previously working package fails after security action | Credential was revoked or rotated and old package still ships old values. | Regenerate HISE package/custom config and release updated package. | REVOKED_CREDENTIAL |
SoundSync
Recovery commands
Use a developer JWT. Do not place these commands or tokens in plugin code.
Reveal
curl
curl -sS -X POST "$SOUNDSYNC_API_BASE/api/developer/plugin-keys/products/prod_demo_piano/reveal-secret" \
-H "Authorization: Bearer $DEVELOPER_JWT" \
-H "Content-Type: application/json" \
-d '{"reason":"package_regeneration"}'
Revoke
curl
curl -sS -X POST "$SOUNDSYNC_API_BASE/api/developer/plugin-keys/products/prod_demo_piano/revoke" \
-H "Authorization: Bearer $DEVELOPER_JWT" \
-H "Content-Type: application/json" \
-d '{"reason":"credential_exposed"}'Customer support rule
Never ask a customer to provide a plugin secret, screenshot a hidden config file, or paste credential headers. Ask for sanitized error code, product version, environment, and timestamp instead.