Managing API keys

API keys serve as unique identifiers for authentication, allowing users, developers, or programs to access an API securely. API keys are often used for tracking and controlling API usage to prevent abuse.

API keys overview

In the API keys section of the Management Console, you can view all API keys associated with your tenant. You can search for keys by name, ID, or owner.

API keys can have the following statuses:

• Active: The API key is currently in use.
• Expired: The expiry date has been reached.
• Revoked: The API key has been revoked and can no longer be used.

Tenant admins can enable API key generation, as well as monitor and revoke API keys. To generate, edit, or delete API keys, the Developer role is required. Tenant admins can assign this role to users, including themselves.

Enabling API keys in the tenant

By default, API keys are disabled. Tenant administrators can enable API keys within the tenant.

Do the following:

1. In the Management Console, go to Settings.
2. Locate the API keys section and select Enable API keys.
3. If needed, adjust the following settings:

   • Change maximum token expiration: Modifies the expiration of newly generated tokens. Existing API keys retain their original expiration value. There is no maximum limit for this value.

     Information noteYou may need to refresh your browser to see the changes to this value reflected in the API keys section on your user profile page.
   • Change maximum of active API keys per user: This setting affects only new API keys. If the limit is reached, the creation of new API keys will be denied. The maximum value is 1000.

4. To begin generating API keys, click Generate new. This will redirect you to the API keys section on your user profile page, where you can create new keys.

Generating API keys

You can generate API keys from the hub. Before you start, make sure that the following requirements are fulfilled:

• You have an active license.

• Enable API keys is togged on in the Management Console.
• You have the Developer role.

Do the following:

1. Click your user profile icon in the upper-right corner and select Profile settings.

2. In the API keys section, click Generate new key.

3. Provide a description and expiration time for the API key.

4. Click Generate to create the key.

5. Immediately copy the generated API key and store it securely. The key cannot be retrieved later.

After creation, you can edit the name of the API key or delete it if necessary.

With your API key, you can explore the REST API reference on qlik.dev using tools like Postman, or install qlik-cli to access Qlik capabilities directly from the command line. For more information, see Overview of Qlik APIs and qlik-cli.

Monitoring and revoking API keys

As a tenant administrator, it's essential to monitor API key activities for security purposes. If suspicious activities are detected, you can revoke the API key.

Remember that revoking an API key will immediately deactivate it, affecting any ongoing processes or integrations relying on it. Revocation is irreversible, and a revoked API key cannot be re-activated.

Do the following:

1. In the Management Console, go to the Events section.

2. Look for any suspicious activities, such as excessive usage of a particular API key.

3. Click next to the event to expand its details and copy the API key ID.

4. Go to the API keys section and search for the API key using its ID.

5. Click next to the key and select Revoke. You can only revoke keys with status Active.

6. To revoke multiple API keys, select them in the table and click Revoke in the upper-right corner.

Deleting API keys

Deleting API keys permanently removes them from the system. Deleting an API key is irreversible and will immediately remove its access privileges. Ensure that this action won't disrupt any ongoing processes or integrations relying on the key.

You need the Developer role to delete API keys.

Do the following:

1. Click your user profile icon in the upper-right corner and select Profile settings.

2. Select the API keys section.

3. Click next to the API key you want to delete and select Delete.

4. If you want to remove all keys, click Delete all above the list of API keys.