API Access
IAM API keys belong to users or service accounts. The owner is the identity that receives access; the key only authenticates it.
Choose a Credential
| Scenario | Credential | Portal location |
|---|---|---|
| Your own CLI, development tool, or script | Personal API key | User menu > API keys |
| Shared integration, production service, automation, or unattended workload | Service-account API key | Access > Service accounts |
| Short-lived token for interactive API testing | Developer token | Admin > Developer tools |
| Integration that still requires the legacy Infuse IoT flow | Legacy IoT admin key | Infuse IoT > API Access |
The Developer tools page links to the personal-key and service-account workflows and shows the active Platform and Infuse IoT organisation identifiers.
Personal API Keys
Create a personal key from Account > API keys. It authenticates as you and always follows your current access in the active organisation. The key has no separate permission scope.
Use personal keys only for activity that should remain attributed to you. Do not use one for a shared or unattended production workload.
Service Accounts
Create a service account from Access > Service accounts for a shared integration or workload:
- Create the service account.
- Open its Access tab and assign the narrowest compatible role, group access, or direct grant.
- Review Effective permissions.
- Open API keys and issue a named key.
- Store the one-time value in a backend secret manager.
Every key for the account has the same current access because access belongs to the service account.
Direct API-Key Authentication
Organisation owners or admins can enable Direct API key authentication from Settings > Organisation Details.
When enabled, supported endpoints can accept an API key directly instead of requiring token exchange. Token exchange remains the recommended default for normal API calls.
Keep every API key server-side. Rotate keys regularly and revoke any credential that is no longer needed or may have been exposed.
For more detail, see API Keys, Service Accounts, Token Exchange, and Rotate and Revoke Credentials.