# Use and rotate Access Keys

Manage, rotate, and revoke retained Access Key credentials.

- Category: Security
- Reading time: 7 分钟
- Locale: ja

## Public access policyPublic Tunnel URLs do not validate Access Keys. Anyone with the URL can connect. Existing Access Key resources and management APIs remain available, but they neither authorize nor block public-host requests.
## Credential managementYou can still create, inspect, and revoke Access Key metadata in the console.

> Do not log plaintext keys: A key is shown only once; if another integration uses it, store it in a Secret Manager.