Scoped API Keys: Restrict Keys per Endpoint and Index, Stop Sharing Your Master Key

· Security · New Feature · All updates

Your master key is root-level and doubles as the initial index password, so handing it to a developer, a contractor or a CI pipeline gives away far more than the task requires. You can now issue additional keys that are scoped to exactly what the holder needs.

01 Create a scoped key

Additional keys are created from Account › API Keys. Each key is restricted to exactly the endpoints you tick and, optionally, to a chosen subset of your indexes. You can also set a date on which the key expires.

MASTER KEY Master key All endpoints, all indexes SCOPED KEY Scoped key Chosen endpoints, chosen indexes Optional expiry
A scoped key carries only the endpoints and indexes you tick, and can be given an expiry date.

02 What you can hand out

  • Search-only access to one index. Give a developer what they need to build against, and nothing more.
  • Ingestion rights and nothing else. Give your CI pipeline Data Ingestion rights only.
  • A key that expires. Hand a contractor a key that stops working on a date you choose.
Keys can be revoked or regenerated instantly, and your master key never has to leave your hands.
Account › API Keys Security & Trust Center

More in Security

View the full changelog