API Keys
An API key is a credential that authenticates as its owning user or service account. The key is not an identity and does not receive roles or permissions of its own.
Choose the Owner
| Need | Use | Manage it from |
|---|---|---|
| Your own CLI, development tool, or personal script | Personal API key | Account > API keys |
| Shared integration, production service, CI/CD job, or unattended workload | Service-account API key | Access > Service accounts > account > API keys |
| Temporary token for interactive API testing | Developer token | Admin > Developer tools |
| Integration that still requires a legacy Infuse IoT admin key | Legacy IoT key | Infuse IoT > API Access |
Personal keys follow the owning member's current organisation access. Service-account keys follow the service account's current access. If a workload needs narrower access than you have, create a purpose-specific service account rather than expecting a personal key to reduce your permissions.
Create a Personal API Key
- Open the user menu and select API keys, or open Account > API keys.
- Enter a key name and optional expiry.
- Select Create key.
- Copy the generated key immediately to a server-side secret manager.
Personal keys are specific to the active organisation. If you work in multiple organisations, create a separate key in each organisation where you need programmatic access.
An authorised administrator can inspect a member's personal key metadata and revoke a key from Access > Members > member > API keys. Administrators cannot reveal a key or issue one for another member.
Create a Service-Account API Key
First create and authorise a service account. Then:
- Open Access > Service accounts.
- Select the account.
- Open API keys.
- Enter a key name and optional expiry.
- Select Issue key.
- Copy the generated key immediately to a server-side secret manager.
The account must be active and unexpired. Issuing a key does not grant new access; all keys for the account authenticate as the same identity.
Store and Use the Key
API keys use this format:
ik_<keyId>.<keySecret>
The complete value is shown only once. Do not expose it in browser code, mobile apps, device firmware, public repositories, logs, or customer-visible examples.
Exchange the key for a short-lived bearer token where supported. Some APIs can accept direct API-key authentication when the organisation setting and endpoint both allow it.