Type: url
Original: https://engineering.mercari.com/en/blog/entry/20260403-secure-devin-management/
Status: generated
Summary
A Mercari Engineering post from the AI Security team on operating Devin’s Enterprise plan across more than ten Organizations, where member assignment, per-Organization credentials and unexpiring API keys had all been manual. It describes six automations built on Devin’s v3 and v2 APIs in Go and GitHub Actions: a custom Terraform provider managing Organizations, members, ACU limits and Devin Knowledge declaratively; bulk secret rotation from Google Cloud Secret Manager; service-account key rotation under an expiry-hours compensating control; audit-log forwarding into an in-house monitoring platform; periodic invalidation of user-issued API keys; and short-interval recreation of the keys internal agents use to reach Devin Wiki through Devin MCP.