Scoped API Key for Drupal Search API Opensolr

A key that only does what the module does

The Drupal module Search API Opensolr connects Search API to your Opensolr indexes. It works with your master API key, but it does not need everything that key can do. Give it a scoped key made for it instead: one box ticks exactly the endpoints the module calls.

Create the key

Open Account › API Keys.
Name this key, for example Drupal site www.example.com.
Under What may this key do?, tick Drupal: Search API Opensolr.
Under Which indexes may it touch?, keep All of my indexes, or tick only the indexes this site uses. If you create new indexes from Drupal, keep all, or add a name pattern that matches them.
Click Create key and copy it.

You do not use the Search API Opensolr Security submodule? Untick its five endpoints before you create the key.

Put it in Drupal

Open the Opensolr settings of Search API: /admin/config/search/search-api/opensolr on your site.
Under Opensolr API Credentials, the Email stays the email of your Opensolr account.
Paste the scoped key as the Secret key and save.

The key must be sent with the email of the account that created it, also when a colleague sets up the site.

What the box ticks: 19 endpoints

Search API Opensolr

Endpoint	What the module uses it for
`get_index_list`	Lists your indexes so you can pick one for a Search API server.
`get_env`	Lists the regions you can create a new index in.
`create_core`	Creates a new index from the module.
`get_core_info`	Reads the address, size and HTTP password of the index when you save the server.
`get_core_status`	Shows the status of the index on the server page.
`reload_core`	Reloads the index after a configuration change.
`commit`	Makes the latest indexed content visible in search.
`optimize`	Optimizes the index on request.
`delete_core`	Deletes an index from the module.
`replicate_index`	Copies an index into another index of yours.
`get_all_config_files`	Lists the configuration files of the index.
`upload_zip_config_files`	Uploads the Search API configuration files as one zip.
`upload_config_file`	Uploads a single configuration file.
`delete_config_file`	Deletes a configuration file.

Search API Opensolr Security (submodule)

Endpoint	What the module uses it for
`update_http_auth`	Sets the HTTP username and password of the index.
`remove_http_auth`	Removes the HTTP password of the index.
`get_ip_list`	Lists the addresses allowed to reach the index.
`add_ip`	Allows an address to reach the index.
`delete_ip`	Removes an allowed address.

Good to know

The module reads the HTTP password of an index with get_core_info, to connect Search API to it. So this key can read the passwords of the indexes it may touch.
A new version of the module may start calling a new endpoint. If it answers 403 ERROR_SCOPED_KEY_ENDPOINT_NOT_ALLOWED, edit the key and tick the box again.
You can change, revoke or regenerate the key at any time on Account › API Keys. See Authentication and keys.