# Create an API Key

> Create a personal or service-account credential for Infuse API access.

Choose the key owner before you begin:

- Use a **personal API key** for your own CLI, development tool, or script when requests should follow your current access.
- Use a **service-account API key** for a shared integration, production service, CI/CD job, or unattended workload.

## Create a Personal API Key

1. Switch to the organisation the key should access.
2. Open the user menu and select **API keys**.
3. Enter a key name and optional expiry.
4. Select **Create key**.
5. Copy the displayed value immediately to a server-side secret manager. It is shown only once.

The key follows your current membership level, roles, groups, direct grants, status, and organisation membership. It does not have separate permissions.

## Create and Authorise a Service Account

1. Open **Access management** > **Service accounts**.
2. Select **Create service account**.
3. Enter a display name and canonical name that identify the workload and environment.
4. Add an optional purpose and account expiry, then select **Create**.
5. Open the account's **Access** tab.
6. Assign the narrowest compatible role or add it to a suitable group.
7. Review **Effective permissions** to confirm the account has only the intended access.
8. Open **API keys**.
9. Enter a key name and optional expiry, then select **Issue key**.
10. Copy the displayed value immediately to a server-side secret manager. It is shown only once.

The service account starts with no access and no credentials. Every key later issued for it authenticates as the same account and receives its current access.

## Use and Rotate the Key

Use token exchange for normal API calls so the long-lived API key remains in secret storage:

```http
POST https://api.infuse-cloud.io/iam/auth/token
Content-Type: application/json

{
  "apiKey": "ik_<keyId>.<keySecret>",
  "audience": "infuse-platform"
}
```

Set `audience` to `infuse-iot` when the token will call the Infuse-IoT Cloud API, or leave the default `infuse-platform` for Infuse Platform APIs. Send the returned short-lived token as `Authorization: Bearer <accessToken>`, and exchange the key again before `expiresAt`.

Rotate a key by issuing a replacement for the same owner, deploying the replacement, confirming it works, and then revoking the old key.

<note>

Legacy Infuse IoT admin keys are deprecated and being retired. Use a personal or service-account API key for Infuse IoT integrations, and [migrate](/docs/iam-and-access/api-tokens#legacy-infuse-iot-admin-keys) any integration that still uses a legacy key.

</note>

See [API Keys](/docs/iam-and-access/api-tokens) and [Token Exchange](/docs/iam-and-access/token-exchange) for credential guidance.