Home > Identity and access > Review API keys

Review API keys

Last updated: 2026-11-03

Cadence: Monthly

Subscription model: All

Roles: Tenant Admin (TA)

Last verified: 2026-09

	Initial	Recurring
Estimated time	30 min	15 min

Benefits:

Prevents outages from unrotated API keys hitting expiry
Detects suspicious key usage patterns via cross-reference with Events
Confirms the Manage API keys permission is still tightly scoped

Goal

API keys are visible to tenant admins from the API keys page in the admin console. Status values are Active, Expired, Revoked. Revocation is irreversible. The Manage API keys permission is now the sole control for API key creation; the legacy Developer role and Enable API keys toggle were removed on January 26, 2026 (see Qlik release notes and deprecation notices). Grant Manage API keys through either a custom role or User Default—and only to users who genuinely need it.

Tasks

Task	TA	AA	DA	AuA
Review keys nearing expiry and rotate before they expire (cross-reference Events for unusual usage)	✓
Confirm the Manage API keys permission (granted via custom role or User Default) is only assigned to users who genuinely need it	✓
Check for orphaned SCIM auto-provisioning keys (see Gotchas)	✓

Gotchas

Orphaned SCIM auto-provisioning API keys (subType=externalClient) persist after SCIM is disabled. Disabling SCIM in the UI doesn't delete the underlying key, and the Resolve button doesn't clear it either. Call DELETE /api/v1/api-keys/<id> manually to silence recurring token about to expire warnings.

Automation helpers

Alert API key owners about API key expiration within X days—Automates the keys-near-expiry review.
Qlik Cloud Monitoring Apps API Key Rotator—Rotates the API keys used by the monitoring apps.

References

Tags: #monthly #identity_and_access #api_keys #security

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here