Skip to main content

Create and restrict an API key

Set the key access mode explicitly. New keys default to admin access, subject to the caller's access cap.

Choose access​

ModeAccess
read-onlyRead requests, including supported analytics query operations
writeReads and configuration writes
adminReads, writes and deletion

A key does not grant access beyond your account membership and resource permissions. Resource grants, teams and capability grants also affect access.

Create a key​

  1. Sign in and choose your account context.
  2. Use your account-context bearer credential to create a key. Set accessMode to write for the setup tasks. Use read-only for an integration that only reads.
  3. Store the returned secret securely as BALANCER_API_KEY for subsequent examples. Do not include it in support requests.

Use https://<your-api-host> as your API base URL. The host is shown in the Balancer portal. Examples use $BALANCER_API_KEY for an existing credential with the required access.

curl --fail-with-body -sS -X POST "https://<your-api-host>/user/api-keys" \
  -H "Authorization: Bearer $BALANCER_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"apiKey":{"name":"setup","accessMode":"write"}}'

API reference: Create an API key for your account user

Expect HTTP 200 with data.apiKey, including accessMode, expiresOn and the new secret. The secret is omitted here.

  1. Read the key metadata to verify that accessMode is write:
curl --fail-with-body -sS -X GET "https://<your-api-host>/user/api-keys" \
  -H "x-api-key: $BALANCER_API_KEY"

API reference: Returns your account user's API keys

Expect HTTP 200 with data.apiKeys. Match the key name and check its mode. Set an explicit expiresOn timestamp when you need expiry. Expired or revoked keys cannot authenticate.

TODO(verify): Confirm whether key-specific resource scoping is supported beyond accessMode and the caller's account and resource grants.

API reference​

Need Help?​

Contact your NetActuate account manager.