# API Keys

> Create personal and service-account API keys for programmatic access.

An API key is a credential that authenticates as its owning user or service account. The key is not an identity and does not receive roles or permissions of its own.

## Choose the Owner

<table>
<thead>
  <tr>
    <th>
      Need
    </th>
    
    <th>
      Use
    </th>
    
    <th>
      Manage it from
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Your own CLI, development tool, or personal script
    </td>
    
    <td>
      Personal API key
    </td>
    
    <td>
      User menu > <strong>
        API keys
      </strong>
    </td>
  </tr>
  
  <tr>
    <td>
      Shared integration, production service, CI/CD job, or unattended workload
    </td>
    
    <td>
      Service-account API key
    </td>
    
    <td>
      <strong>
        Access management
      </strong>
      
       > <strong>
        Service accounts
      </strong>
      
       > account > <strong>
        API keys
      </strong>
    </td>
  </tr>
  
  <tr>
    <td>
      Temporary token for interactive API testing
    </td>
    
    <td>
      Developer token
    </td>
    
    <td>
      <strong>
        Organisation settings
      </strong>
      
       > <strong>
        Developer tools
      </strong>
    </td>
  </tr>
</tbody>
</table>

Personal keys follow the owning member's current organisation access. Service-account keys follow the service account's current access. If a workload needs narrower access than you have, create a purpose-specific service account rather than expecting a personal key to reduce your permissions.

## Create a Personal API Key

1. Switch to the organisation the key should access.
2. Open the user menu and select **API keys**.
3. Enter a key name and optional expiry. Leave the expiry blank for a key that does not expire.
4. Select **Create key**.
5. Copy the generated key immediately to a server-side secret manager.

Personal keys are specific to the active organisation. If you work in multiple organisations, create a separate key in each organisation where you need programmatic access.

An authorised administrator can inspect a member's personal key metadata, remove a key's expiry, or revoke a key from **Access management** > **Members** > member > **API keys**. Administrators cannot reveal a key or issue one for another member.

## Create a Service-Account API Key

First [create and authorise a service account](/docs/iam-and-access/service-accounts). Then:

1. Open **Access management** > **Service accounts**.
2. Select the account.
3. Open **API keys**.
4. Enter a key name and optional expiry.
5. Select **Issue key**.
6. Copy the generated key immediately to a server-side secret manager.

The account must be active and unexpired. Issuing a key does not grant new access; all keys for the account authenticate as the same identity.

## Review Key Status

Each key list shows the key name, status, creation time, expiry, and when the key was last used. Use **Last used** to find keys that are no longer needed before you revoke them.

## Remove a Key Expiry

Select **Remove expiry** beside an unrevoked key that has an expiry, then confirm. The same key continues to work with no expiry; you do not need to reissue it or update the client.

If the key has already expired, removing its expiry allows it to authenticate again. A personal key still requires its owner to be a current member of the organisation, and a service-account key still requires an active, unexpired service account.

Removing an expiry cannot be used to restore a revoked key. Prefer rotation over removing an expiry when the key may have been exposed.

## Store and Use the Key

API keys use this format:

```text
ik_<keyId>.<keySecret>
```

The complete value is shown only once. Do not expose it in browser code, mobile apps, device firmware, public repositories, logs, or customer-visible examples.

Exchange the key for a short-lived bearer token. Use `"audience": "infuse-iot"` when the token will call the Infuse-IoT Cloud API, or the default `infuse-platform` audience for Infuse Platform APIs. See [Token Exchange](/docs/iam-and-access/token-exchange).

Some Platform APIs can also accept direct API-key authentication when the organisation setting and endpoint both allow it.

## Use a Key With Infuse IoT

Use personal and service-account API keys for Infuse-IoT Cloud API calls and the [Infuse Python Tools](/docs/infuse-iot-sdk/python-tools/credentials). The key's IoT access comes from its owner's IoT roles and grants, so assign an IoT role, such as **IoT Viewer** or **IoT Admin**, before using it.

## Legacy Infuse IoT Admin Keys

Legacy Infuse IoT admin keys are deprecated and being retired. A retirement date has not been announced. Do not use them for new integrations.

Existing legacy keys continue to work until retirement. To migrate an integration that uses one:

1. Create a service account for the integration and assign the IoT role it needs.
2. Issue an API key for the service account.
3. Update the integration to exchange the key for an `infuse-iot` token and send it as `Authorization: Bearer <accessToken>`.
4. Confirm the integration works, then stop using the legacy key.

Legacy keys are managed from **Infuse IoT** > **API Access**. They do not use the `ik_` format and cannot be converted into IAM API keys.