API Keys

An API key is a credential that authenticates as its owning user or service account. The key is not an identity and does not receive roles or permissions of its own.

Choose the Owner

Personal keys follow the owning member's current organisation access. Service-account keys follow the service account's current access. If a workload needs narrower access than you have, create a purpose-specific service account rather than expecting a personal key to reduce your permissions.

Create a Personal API Key

1. Switch to the organisation the key should access.
2. Open the user menu and select API keys.
3. Enter a key name and optional expiry. Leave the expiry blank for a key that does not expire.
4. Select Create key.
5. Copy the generated key immediately to a server-side secret manager.

Personal keys are specific to the active organisation. If you work in multiple organisations, create a separate key in each organisation where you need programmatic access.

An authorised administrator can inspect a member's personal key metadata, remove a key's expiry, or revoke a key from Access management > Members > member > API keys. Administrators cannot reveal a key or issue one for another member.

Create a Service-Account API Key

First create and authorise a service account. Then:

1. Open Access management > Service accounts.
2. Select the account.
3. Open API keys.
4. Enter a key name and optional expiry.
5. Select Issue key.
6. Copy the generated key immediately to a server-side secret manager.

The account must be active and unexpired. Issuing a key does not grant new access; all keys for the account authenticate as the same identity.

Review Key Status

Each key list shows the key name, status, creation time, expiry, and when the key was last used. Use Last used to find keys that are no longer needed before you revoke them.

Remove a Key Expiry

Select Remove expiry beside an unrevoked key that has an expiry, then confirm. The same key continues to work with no expiry; you do not need to reissue it or update the client.

If the key has already expired, removing its expiry allows it to authenticate again. A personal key still requires its owner to be a current member of the organisation, and a service-account key still requires an active, unexpired service account.

Removing an expiry cannot be used to restore a revoked key. Prefer rotation over removing an expiry when the key may have been exposed.

Store and Use the Key

API keys use this format:

ik_<keyId>.<keySecret>

The complete value is shown only once. Do not expose it in browser code, mobile apps, device firmware, public repositories, logs, or customer-visible examples.

Exchange the key for a short-lived bearer token. Use "audience": "infuse-iot" when the token will call the Infuse-IoT Cloud API, or the default infuse-platform audience for Infuse Platform APIs. See Token Exchange.

Some Platform APIs can also accept direct API-key authentication when the organisation setting and endpoint both allow it.

Use a Key With Infuse IoT

Use personal and service-account API keys for Infuse-IoT Cloud API calls and the Infuse Python Tools. The key's IoT access comes from its owner's IoT roles and grants, so assign an IoT role, such as IoT Viewer or IoT Admin, before using it.

Legacy Infuse IoT Admin Keys

Legacy Infuse IoT admin keys are deprecated and being retired. A retirement date has not been announced. Do not use them for new integrations.

Existing legacy keys continue to work until retirement. To migrate an integration that uses one:

1. Create a service account for the integration and assign the IoT role it needs.
2. Issue an API key for the service account.
3. Update the integration to exchange the key for an infuse-iot token and send it as Authorization: Bearer <accessToken>.
4. Confirm the integration works, then stop using the legacy key.

Legacy keys are managed from Infuse IoT > API Access. They do not use the ik_ format and cannot be converted into IAM API keys.