API Access
IAM API keys belong to users or service accounts. The owner is the identity that receives access; the key only authenticates it.
Choose a Credential
| Scenario | Credential | Portal location |
|---|---|---|
| Your own CLI, development tool, or script | Personal API key | User menu > API keys |
| Shared integration, production service, automation, or unattended workload | Service-account API key | Access management > Service accounts |
| Short-lived token for interactive API testing | Developer token | Organisation settings > Developer tools |
Personal and service-account API keys are the standard credentials for both Infuse Platform APIs and the Infuse-IoT Cloud API. Legacy Infuse IoT admin keys are deprecated and being retired; migrate any integration that still uses one. Exchange the key for a token with the audience of the API you are calling; see Token Exchange.
The Developer tools page links to the personal-key and service-account workflows and shows the active organisation's Platform and Infuse IoT organisation IDs. These are the same value.
Personal API Keys
Create a personal key from the user menu > API keys. It authenticates as you and always follows your current access in the active organisation. The key has no separate permission scope.
Use personal keys only for activity that should remain attributed to you. Do not use one for a shared or unattended production workload.
Service Accounts
Create a service account from Access management > Service accounts for a shared integration or workload:
- Create the service account.
- Open its Access tab and assign the narrowest compatible role, group access, or direct grant.
- Review Effective permissions.
- Open API keys and issue a named key.
- Store the one-time value in a backend secret manager.
Every key for the account has the same current access because access belongs to the service account.
Direct API-Key Authentication
Organisation owners or admins can enable Direct API key authentication from Organisation settings > General.
When enabled, supported endpoints can accept an API key directly instead of requiring token exchange. Token exchange remains the recommended default for normal API calls.
Keep every API key server-side. Rotate keys regularly and revoke any credential that is no longer needed or may have been exposed.
For more detail, see API Keys, Service Accounts, Token Exchange, and Rotate and Revoke Credentials.