One key rules everything. The others do exactly one job.
Every Opensolr account has a master API key with root-level access — and, since 2026, as many scoped API keys as you need, each limited to the endpoints and indexes you choose.
The master API key — treat it as root
Every account has exactly one master key, shown in your Dashboard. It is unrestricted: it can call every endpoint of the Opensolr REST API, on every index you own.
When Opensolr creates an index for you, the master key is set as the initial HTTP Basic Auth password on it. So whoever holds your master key can not only manage your account through the API — they can query your Solr indexes directly, until you change those credentials under Security. See also Default HTTP Auth Credentials.
- Never paste it into client-side code, a shared repository, a CI log or a chat window.
- Never give it to a contractor, an agency or a colleague — issue them a scoped key instead.
- Regenerate it from the Dashboard if it may have leaked. Regenerating does not change your index HTTP credentials.
- Rotating the master key breaks anything still using the old value — update your applications first.
Scoped API keys — least privilege by design
A scoped key is an additional API key that carries only the permissions you grant it. Everything else is refused. You create them under Account › API Keys, and you can hold as many as you need.
Tick exactly what the key may call — search only, ingest only, crawler control, and so on. Anything unticked returns 403 ERROR_SCOPED_KEY_ENDPOINT_NOT_ALLOWED.
Restrict a key to a chosen subset of your indexes. Calls against any other index return 403 ERROR_SCOPED_KEY_CORE_NOT_ALLOWED. Leave it unrestricted and the key covers all of your indexes.
Give a contractor or a temporary integration a key that stops authenticating on a date you choose. Leave it empty for a key that never expires.
Disable, regenerate or delete any key instantly. Your master key and every other scoped key keep working.
| The key is for | Endpoints you would grant | Indexes |
|---|---|---|
| A front-end developer | embed_and_search, get_core_info | One index |
| A CI / deployment pipeline | ingest, ingest_status | The staging index |
| A RAG or AI application | embed, embed_and_search, ai_summary | The content index |
| A contractor, for two weeks | Whatever the task needs | Their project index, with an expiry date |
Creating a scoped key
Exactly like the master key: pass it as api_key together with your account email. Nothing else changes in your code.
curl -X POST https://api.opensolr.com/solr_manager/api/ingest \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com","api_key":"YOUR_SCOPED_KEY",
"core_name":"your_index","documents":[ ... ]}'Rate limits and monthly quotas are counted against your account, whichever key is used — see API Usage.
Scoped keys vs Teams — machines vs people
A colleague logs in with their own account. You choose which indexes they see and which actions they may perform in the control panel. They never receive a credential of yours. See Teams Management.
Scripts, back-end services, CI jobs and AI agents authenticate with a key, not a login. Give each system its own key so you can revoke one without disturbing the others.
Key management is reserved to the account owner. Team members cannot create, revoke or regenerate API keys, in the same way they cannot touch billing.
Issue a key that does exactly one job, on exactly the indexes you choose, and revoke it the day it is no longer needed.
Create a scoped keySecurity & Trust Center