Skip to main content
Version: V3.7

API Keys

The API Keys page manages the set of bearer tokens accepted by the QSDA Service when API authentication is enabled. A key is accepted only when it is enabled, present in this set, and not expired.

API authentication is turned on with the Use API Auth option in API Security. If that option is off, a warning at the top of the page indicates that keys created here are not enforced and the API will accept requests without a key.

Key List​

The grid lists every API key that has been issued, with these columns:

  • Name -- The friendly name supplied when the key was created.
  • Issued (UTC) -- When the key was created.
  • Expires (UTC) -- The expiration timestamp, or Never if the key was created as non-expiring.
  • Last used -- Relative time since the key was last presented to the API, or Never if it has not yet been used.
  • Status -- Active, Disabled, or Expired.

Selecting a row reveals the Disable Key / Enable Key and Delete Key buttons.

Create Key​

Click Create Key to open the create dialog.

  • Name -- A friendly identifier (e.g. Reporting Bot) so the key can be recognized later in the list. Required.
  • Expiration -- Choose 30 days, 90 days (default), 1 year, Custom date, or Never expires.

Choosing Custom date reveals a date picker; the date must be in the future.

Choosing Never expires displays a warning. A non-expiring key remains valid until it is explicitly disabled or deleted, so anyone who obtains the key can call the API indefinitely. You must check the acknowledgement box before the key can be created. Use this option only for trusted internal automation.

When the key is created, the full token is displayed once in a follow-up dialog. Copy this token immediately. After the dialog is closed, only the metadata (name, expiration, status) remains visible. If the token is lost, delete the key and create a new one.

Disable / Enable Key​

Disabling a key takes it out of service without removing it from the list. Any API client presenting a disabled key is rejected immediately. The key can be re-enabled later, restoring access without the client needing a new token.

Delete Key​

Deleting a key permanently removes it. Any client still using the key loses access immediately and must be issued a new key. This action cannot be undone.