diff --git a/go.mod b/go.mod
index 0503c20..d827ef4 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/databacker/mysql-backup
 
 go 1.26.0
 
-require github.com/databacker/api v1.10.0
+require github.com/databacker/api v1.10.1
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.41.6
diff --git a/go.sum b/go.sum
index 2757161..3ba7402 100644
--- a/go.sum
+++ b/go.sum
@@ -88,6 +88,8 @@ github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfc
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/databacker/api v1.10.0 h1:fzMJ8vX7puh8LmdD04psVY4CF5XEpgnaMDb3GWwxAZ8=
 github.com/databacker/api v1.10.0/go.mod h1:r6PURrVPQLvq0lwoVHXl3mJAi7Y23URb9X5cFlLwOko=
+github.com/databacker/api v1.10.1 h1:u3zw38Xz4UoaM0Fr42GvWH/99EOFWP5uH49oekxt8xY=
+github.com/databacker/api v1.10.1/go.mod h1:r6PURrVPQLvq0lwoVHXl3mJAi7Y23URb9X5cFlLwOko=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
diff --git a/pkg/identity/identity.go b/pkg/identity/identity.go
index 41df234..df4ace9 100644
--- a/pkg/identity/identity.go
+++ b/pkg/identity/identity.go
@@ -22,8 +22,8 @@ const (
 	credentialSalt         = "databacker engine credential v2"
 	authenticationInfo     = "databacker/authentication/ed25519/v1/generation/"
 	configurationInfo      = "databacker/configuration-encryption/x25519/v1/generation/"
-	authenticationIDDomain = "databacker/engine-key-id/authentication/ed25519/v1\x00"
-	configurationIDDomain  = "databacker/engine-key-id/configuration-encryption/x25519/v1\x00"
+	authenticationIDDomain = string(api.AuthenticationDomain)
+	configurationIDDomain  = string(api.ConfigurationDomain)
 )
 
 // Identity contains validated credential state. Its secret material is
@@ -178,6 +178,7 @@ func (i *Identity) hasConfigurationGeneration(generation uint64) bool {
 func keyID(prefix, domain string, generation uint64, publicKey []byte) string {
 	hash := sha256.New()
 	_, _ = hash.Write([]byte(domain))
+	_, _ = hash.Write([]byte{0})
 	var encodedGeneration [8]byte
 	binary.BigEndian.PutUint64(encodedGeneration[:], generation)
 	_, _ = hash.Write(encodedGeneration[:])