[Home](https://help.qlik.com/en-US/cloud-admin-playbook/Content/home.htm) > [Identity and access](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access.htm) > Review API keys

# Review API keys

**Cadence:** Monthly

**Subscription model:** All

**Roles:** Tenant Admin (TA)

**Last verified:** 2026-09

|  | Initial | Recurring |
| --- | --- | --- |
| **Estimated time** | 30 min | 15 min |

**Benefits:**

* Prevents outages from unrotated API keys hitting expiry
* Detects suspicious key usage patterns via cross-reference with Events
* Confirms the Manage API keys permission is still tightly scoped

***

## Goal

API keys are visible to tenant admins from the **API keys** page in the admin console. Status values are Active, Expired, Revoked. **Revocation is irreversible.** The **Manage API keys** permission is now the sole control for API key creation; the legacy **Developer** role and **Enable API keys** toggle were removed on January 26, 2026 (see [Qlik release notes and deprecation notices](https://help.qlik.com/en-US/cloud-admin-playbook/Content/tenant_configuration/review_release_changes.htm#references)). Grant **Manage API keys** through either a custom role or User Default—and only to users who genuinely need it.

## Tasks

| Task | TA | AA | DA | AuA |
| --- | --- | --- | --- | --- |
| Review keys nearing expiry and rotate before they expire (cross-reference Events for unusual usage) | ✓ |  |  |  |
| Confirm the **Manage API keys** permission (granted via custom role or User Default) is only assigned to users who genuinely need it | ✓ |  |  |  |
| Check for orphaned SCIM auto-provisioning keys (see Gotchas) | ✓ |  |  |  |

## Gotchas

* **Orphaned SCIM auto-provisioning API keys (`subType=externalClient`) persist after SCIM is disabled.** Disabling SCIM in the UI doesn't delete the underlying key, and the
  > Resolve

  button doesn't clear it either. Call `DELETE /api/v1/api-keys/<id>` manually to silence recurring
  > token about to expire

  warnings.

## Automation helpers

* **Alert API key owners about API key expiration within X days**—Automates the keys-near-expiry review.
* **Qlik Cloud Monitoring Apps API Key Rotator**—Rotates the API keys used by the monitoring apps.

## References

* [Managing API keys](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/mc-generate-api-keys.htm)
* [Generate your first API key (qlik.dev)](https://qlik.dev/authenticate/api-key/generate-your-first-api-key/)
* [Qlik Cloud Error: 401 Authorization Required after removal of deprecated Developer role and Enable API keys toggle](https://community.qlik.com/t5/Official-Support-Articles/Qlik-Cloud-Removing-the-deprecated-Developer-role-and-Enable-API/ta-p/2534952)
* [Developer role and Enable API keys toggle removed (qlik.dev changelog)](https://qlik.dev/changelog/198-developer-role-removal/)

**Tags:** `#monthly` `#identity_and_access` `#api_keys` `#security`