API Keys Screen

Open API Keys from the main navigation to create and manage authorization for Workflow invocations.

Explorer

The explorer searches API Key names and IDs. You can switch between the available layouts, select or star items, organize keys in folders, and use breadcrumbs to move through the folder hierarchy.

The list includes each key's name and ID, status, type, assigned-Workflow count, last changed time, and last used time. The grid cards show status, assigned-Workflow count, and type.

Filters

Use the filters to narrow the list by:

  • Type: Service token, Cookie, Delegate MCP user, Certificate, or Legacy Basic.
  • Status: Enabled or Disabled.
  • Used recently.
  • Changed recently.

Legacy types remain visible so existing keys can be identified and replaced. They are not available when creating a key.

Actions

Your permissions determine which actions are available:

  • New API Key opens a blank API Key details page.
  • New folder creates an API Key folder.
  • Rename changes the selected key or folder name.
  • Move to moves selected items to another folder.
  • Delete permanently deletes selected keys or folders after confirmation.
  • Download all (.csv) exports the visible API Key data, including URL, folder path, ID, name, status, type, Workflow count, last changed time, and last used time. Secret values are never included.

API Key details

Select an existing key or create a new one to open the details page.

Page actions

  • Save changes creates or updates the key. A name and target Environment are required.
  • Delete permanently deletes a saved key after confirmation.
  • Relationships opens a new tab showing objects related to the key in its target Environment.
  • Audit trail opens a new tab containing the key's audit records.
  • Download OpenAPI definition exports definitions for the assigned Workflows. It is unavailable for Delegate MCP user keys and until the required key, Environment, Site, and Workflow information exists.
  • Help opens the API or MCP documentation appropriate to the key type.

Shared fields

API key type determines the authorization model. Choose Service token, Cookie, or, when supported by the subscription, Delegate MCP user. The type becomes read-only after the first save.

API key name identifies the authorization context in Console and runtime records.

Enabled controls whether the key may authorize invocations.

Target Environment specifies the Environment the key applies to. The first available Environment is selected for a new key. The field becomes read-only after the first save because the Environment is part of the key's protected storage and authorization scope.

Assigned Workflows lists the Workflows that the key may invoke. Use Assign a Workflow to search for and add a Workflow, or use the remove button beside an assignment. v2 Runtime Workflows carry a v2 Runtime badge. Missing assignments are shown by ID with a Workflow not found badge so they can be removed.

For a service-token or Cookie key, the Workflow selector includes v2 Runtime Workflows and v1 Runtime Workflows that have an HTTP binding. For a Delegate MCP user key, it includes v2 Runtime Workflows and v1 Runtime Workflows that are enabled and named as MCP tools.

Service-token fields

Primary key and Secondary key show the two independent secret values after the key is first saved. Copy both values before leaving the page because they cannot be retrieved later.

Regenerate replaces only the selected secret after confirmation. The previous value stops authorizing invocations, while the other secret remains unchanged. The replacement is shown once. See Rotate an API Key.

User-authorized fields

Cookie and Delegate MCP user keys show Permitted users and Assign a user instead of secret fields. Search for and add Site users, or remove users from the assignment list.

When Environment-scoped permissions are enabled, No Environment access identifies an assigned user who cannot access the target Environment. Saving synchronizes the assignment and removes users without the required access. A user ID that no longer resolves is shown with User not found so it can be removed.

Immutable settings

The API Key type and target Environment cannot be changed after creation. Create a replacement key when either needs to change, move consumers or user authorization to it, and then disable or delete the old key.