Legacy key migration

The platform exposed AppKey and SecurityKey for years. Both still work, but new code should use scoped API keys. The migration tool maps each legacy pair to a new key with the equivalent scope set.

Run the migration

solidcommerce migrate legacy-keys --account $ACCOUNT_ID --dry-run
solidcommerce migrate legacy-keys --account $ACCOUNT_ID --apply

A dry-run prints the planned mapping. The --apply step:

1. Creates a new API key for each legacy pair, copying the scope set.
2. Marks the legacy pair as deprecated_at = now().
3. Sends the customer an onboarding email with the new key.

Why migrate

• New keys carry an explicit scope list — least privilege.
• Audit log records which key made every call.
• Keys can be rotated and revoked individually without breaking other automations.
• Legacy keys are slated for sunset (date in the deprecation policy).