A new master key, and the old one stops
Your master API key can do everything on your account: create and delete indexes, change their passwords, read and write their data. Replace it when you are not sure who has seen it, when someone with access leaves, or simply from time to time.
How
- Open your account dashboard.
- Click Generate A New API Key.
- Copy the new key from the dashboard, or from Account › API Keys.
Only the account owner sees the button. Team members sign in with their own account and are not affected.
What happens at once
- The old key stops working for every API call, right away. There is no grace period.
- Scheduled backups, scheduled optimize and Keep fresh move to the new key on their own.
- Scoped keys keep working. They are separate keys.
- Phones signed in with their own key keep working. A phone marked Account key under Account › Devices used the old master key: it asks to sign in again.
- The passwords of your indexes do not change. If an index still has the old key as its password, the old key still opens that index. Change it too.
What you have to update
Everything that sends the old key fails until it has the new one:
- The Drupal module Opensolr Search: the API Key in its settings.
- The Drupal module Search API Opensolr: the Secret key in its Opensolr settings.
- The WordPress plugin Opensolr Search: the API Key under Settings › Opensolr Search.
- Your own scripts and apps, and the developer packages (LangChain, LlamaIndex, Haystack, MCP, Laravel Scout).
Better: give each of them a scoped key. The next time you replace your master key, nothing else has to change.