Every Opensolr account has one master API key that can do everything, and as many scoped keys as you need, each limited to what you grant it.
01 · The master key
It can do everything
Every endpoint of the Opensolr API, on every index of your account: create and delete indexes, change configuration files and passwords, spend your AI allowance.
It is also the first index password
A new index gets your master key as its HTTP password, so whoever holds the key can also query your indexes until you change their credentials: Default HTTP Auth Credentials.
Where to find it
Account › API Keys, under Master API key, and on your dashboard as Master REST API Key.
Replace it if it may have leaked
Generate A New API Key on your dashboard, then update your apps: anything still using the old value stops working. The passwords of your existing indexes do not change.
02 · Scoped keys
Only the endpoints you tick
Anything else answers 403 ERROR_SCOPED_KEY_ENDPOINT_NOT_ALLOWED.
Only the indexes you pick
All of your indexes, some of them, or names that match a pattern. Anything else answers 403 ERROR_SCOPED_KEY_CORE_NOT_ALLOWED.
Until a date you choose
An optional expiry date, after which the key stops working.
Each one on its own
Revoke, regenerate or delete one key without touching the master key or any other key.
Create one, step by step: Create a scoped API key.
03 · Keys and teams
| For | Use |
|---|---|
| A person who works in the Control Panel | A team: they sign in with their own account and work on the indexes you share with them: Teams. |
| An app, a script, a CI job or an AI agent | A scoped key, one per system, so you can revoke one without disturbing the others. |
Team members never see your keys. With their own email and API key they can also act through the API on the indexes you shared with them.
Rate limits and monthly quotas count against your account, whichever key is used: API Quota.