feat(web): manage custom ingest keys in ingestion settings

apps/landing/src/content/docs/reference/authentication.md

@@ -11,6 +11,7 @@ Maple uses two kinds of credential. **Ingest keys** send telemetry. **API keys**
 | ------------------ | ----------- | ---------------------------------------- | ---------------------------------------------- | ---------------------------- |
 | Public ingest key  | `maple_pk_` | **Settings → Ingestion**                 | Send telemetry                                 | Yes                          |
 | Private ingest key | `maple_sk_` | **Settings → Ingestion**                 | Send telemetry                                 | No                           |
+| Custom ingest key  | `maple_ik_` | **Settings → Ingestion → Keys**          | Send the signals you allow, up to its limit    | No                           |
 | API key            | `maple_ak_` | **Settings → API Keys**                  | REST API and MCP server, limited by its scopes | No                           |
 | MCP key            | `maple_ak_` | **Settings → MCP**                       | MCP server only                                | No                           |
 | OAuth token        |             | Issued to an MCP client when you sign in | MCP server only                                | No                           |
@@ -19,11 +20,11 @@ Every credential belongs to one organization in one [region](/docs/reference/reg
 
 ## Which endpoint accepts what
 
-| Endpoint                                | Accepts                                                                               |
-| --------------------------------------- | ------------------------------------------------------------------------------------- |
-| Ingest, `https://ingest.maple.dev/v1/*` | Public or private ingest key, as `Authorization: Bearer …` or `x-maple-ingest-key: …` |
-| REST API, `https://api.maple.dev/v2/*`  | API key, or a dashboard session token, as `Authorization: Bearer …`                   |
-| MCP server, `https://api.maple.dev/mcp` | API key, MCP key or OAuth token, as `Authorization: Bearer …`                         |
+| Endpoint                                | Accepts                                                                 |
+| --------------------------------------- | ----------------------------------------------------------------------- |
+| Ingest, `https://ingest.maple.dev/v1/*` | Any ingest key, as `Authorization: Bearer …` or `x-maple-ingest-key: …` |
+| REST API, `https://api.maple.dev/v2/*`  | API key, or a dashboard session token, as `Authorization: Bearer …`     |
+| MCP server, `https://api.maple.dev/mcp` | API key, MCP key or OAuth token, as `Authorization: Bearer …`           |
 
 Use the EU hosts (`ingest.eu.maple.dev`, `api.eu.maple.dev`) for an EU organization.
 
@@ -42,6 +43,21 @@ To rotate a key, click **Regenerate** next to it in **Settings → Ingestion**,
 
 The literal key `MAPLE_TEST` is accepted and returns `200`, but the data is discarded. Use it in CI or example code.
 
+### Custom ingest keys
+
+Beside the default pair you can create named keys under **Settings → Ingestion → Custom keys**, or with `POST /v2/ingest_keys/custom`. Give one to a team, a service or an environment so you can limit and revoke it on its own. Each key has:
+
+| Setting                 | What it does                                                                                                                                                                 |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Allowed signals**     | Traces, logs, metrics, sessions (replays and session events) and events (product events, including browser `track()` calls). Other signals are rejected with `403`.          |
+| **Rate limit**          | Requests per second, split across the ingest servers. Requests over it get `429` with a `Retry-After` header.                                                                |
+| **Resource attributes** | Written on every resource the key sends over OTLP (traces, logs, metrics). **Always** overwrites the sender's value; **If missing** only fills it in. `maple_*` is reserved. |
+| **Expires**             | Never, or a date after which the key gets `401`.                                                                                                                             |
+
+The key is shown once, when it is created or rolled; Maple keeps only a hash. Telemetry sent with a custom key carries a `maple_ingest_key_id` resource attribute with the key's `ingk_…` ID, so you can filter by key. Each key's page shows when it last sent data and its span and log volume over the last 24 hours.
+
+**Pausing** a key (for an hour, a day, or until you resume it, or with `POST /v2/ingest_keys/custom/{id}/pause`) keeps answering senders with success, so nothing retries or backs up, but drops what they send: it is not stored or billed. Revoke a key by rolling or deleting it instead. Edits, pauses, rolling and deleting reach the ingest servers within a minute.
+
 ## API keys
 
 Create API keys under **Settings → API Keys**, or with `POST /v2/api_keys`. When you create one you choose:

apps/web/src/components/settings/ingest-keys/key-detail.browser.test.tsx

@@ -0,0 +1,126 @@
+// TEST-SEAM: the atom client and the list atom are process-global wiring with no
+// instance-level injection seam, so the hooks are replaced at the module boundary.
+import { cleanup, fireEvent, render, screen, within } from "@testing-library/react"
+import { Exit, Schema } from "effect"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import { V2CustomIngestKey } from "@maple/domain/http/v2"
+
+const mutations = {
+	pauseCustom: vi.fn(async (_input: { payload: { until: string | null } }) => Exit.succeed({})),
+	resumeCustom: vi.fn(async (_input: unknown) => Exit.succeed({})),
+	rollCustom: vi.fn(async (_input: unknown) =>
+		Exit.succeed({ secret: "maple_ik_rolledSecret000000000000000000" }),
+	),
+	deleteCustom: vi.fn(async (_input: unknown) => Exit.succeed({})),
+}
+interface ListState {
+	key: V2CustomIngestKey | null
+}
+const state: ListState = { key: null }
+
+vi.mock("@/lib/effect-atom", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("@/lib/effect-atom")>()
+	return {
+		...actual,
+		useAtomValue: (atom: string) =>
+			atom === "list"
+				? actual.Result.success({ data: state.key === null ? [] : [state.key] })
+				: actual.Result.success({
+						object: "custom_ingest_key_usage",
+						window_start: "2026-07-14T10:00:00.000Z",
+						window_end: "2026-07-15T10:00:00.000Z",
+						buckets: [],
+					}),
+		useAtomRefresh: () => () => {},
+		useAtomSet: (name: keyof typeof mutations) => mutations[name],
+	}
+})
+vi.mock("@/lib/services/common/v2-atom-client", () => ({
+	MapleApiV2AtomClient: { mutation: (_group: string, name: string) => name },
+	retainedQueryV2: () => "usage",
+}))
+vi.mock("@/lib/services/atoms/ingestion-atoms", () => ({ customIngestKeysListAtom: "list" }))
+vi.mock("@tanstack/react-router", () => ({ Link: (props: { children?: unknown }) => props.children }))
+
+import { IngestKeyDetail } from "./key-detail"
+
+const decodeKey = Schema.decodeUnknownSync(V2CustomIngestKey)
+const baseKey = {
+	id: "ingk_aXunrkWtzvXSkw9Z2smcft",
+	object: "custom_ingest_key",
+	name: "Mobile app",
+	description: null,
+	key_prefix: "maple_ik_Q7xZa",
+	status: "active",
+	allowed_signals: null,
+	rate_limit_rps: null,
+	resource_attributes: [],
+	expires_at: null,
+	paused_at: null,
+	paused_until: null,
+	last_used_at: null,
+	rolled_at: "2026-07-01T12:00:00.000Z",
+	created_at: "2026-07-01T12:00:00.000Z",
+	updated_at: "2026-07-01T12:00:00.000Z",
+}
+
+afterEach(() => {
+	cleanup()
+	vi.clearAllMocks()
+})
+
+const renderDetail = (key: V2CustomIngestKey, onRevealed = vi.fn()) => {
+	state.key = key
+	render(
+		<IngestKeyDetail
+			keyId={key.id}
+			revealed={null}
+			onRevealed={onRevealed}
+			onConfigure={vi.fn()}
+			onDeleted={vi.fn()}
+		/>,
+	)
+	return onRevealed
+}
+
+describe("IngestKeyDetail", () => {
+	it("pauses for an hour with an absolute deadline, and until resumed with none", async () => {
+		renderDetail(decodeKey(baseKey))
+		const before = Date.now()
+
+		fireEvent.click(screen.getByRole("button", { name: "Pause" }))
+		fireEvent.click(await screen.findByRole("menuitem", { name: "For 1 hour" }))
+		await vi.waitFor(() => expect(mutations.pauseCustom).toHaveBeenCalledTimes(1))
+		const until = new Date(mutations.pauseCustom.mock.calls[0]?.[0].payload.until ?? 0).getTime()
+		expect(until - before).toBeGreaterThanOrEqual(3_600_000)
+		expect(until - Date.now()).toBeLessThanOrEqual(3_600_000)
+
+		cleanup()
+		renderDetail(decodeKey(baseKey))
+		fireEvent.click(screen.getByRole("button", { name: "Pause" }))
+		fireEvent.click(await screen.findByRole("menuitem", { name: "Until I resume" }))
+		await vi.waitFor(() => expect(mutations.pauseCustom).toHaveBeenCalledTimes(2))
+		expect(mutations.pauseCustom.mock.calls[1]?.[0]).toMatchObject({ payload: { until: null } })
+	})
+
+	it("offers resume on a paused key and hands a rolled secret up", async () => {
+		const onRevealed = renderDetail(
+			decodeKey({ ...baseKey, status: "paused", paused_at: "2026-07-01T12:00:00.000Z" }),
+		)
+
+		expect(screen.queryByRole("button", { name: "Pause" })).toBeNull()
+		fireEvent.click(screen.getByRole("button", { name: "Resume now" }))
+		await vi.waitFor(() => expect(mutations.resumeCustom).toHaveBeenCalledTimes(1))
+
+		fireEvent.click(screen.getByRole("button", { name: "Roll secret" }))
+		const dialog = await screen.findByRole("alertdialog")
+		fireEvent.click(within(dialog).getByRole("button", { name: "Roll secret" }))
+		await vi.waitFor(() =>
+			expect(onRevealed).toHaveBeenCalledWith({
+				keyId: state.key?.id,
+				secret: "maple_ik_rolledSecret000000000000000000",
+				rolled: true,
+			}),
+		)
+	})
+})