Switch Your Apps to Scoped API Keys

One key per app

When every site and script uses your master key, a leak anywhere opens your whole account, and replacing the key breaks all of them at once. A scoped key belongs to one app: it can only call what you tick, on the indexes you pick, until a date you choose.

How to switch

1. Open Account › API Keys and create a scoped key for one app. For an Opensolr module, one box ticks everything it needs: Drupal Opensolr Search, Drupal Search API Opensolr, WordPress.
2. Put the scoped key in that app, in place of the master key. The email stays the email of your account.
3. Check that the app still works, then move to the next one.
4. When no app uses the master key any more, generate a new one and keep it to yourself.

What a scoped key does

• An endpoint you did not tick answers 403 ERROR_SCOPED_KEY_ENDPOINT_NOT_ALLOWED. An index outside its list answers 403 ERROR_SCOPED_KEY_CORE_NOT_ALLOWED. Nothing runs.
• Revoke stops it at once, Enable brings it back. Regenerate gives it a new value and the old value stops at once. After its expiry date it stops on its own.
• Generating a new master key does not touch your scoped keys.
• It always goes with the email of the account that created it, also in the hands of a colleague.
• Rate limits and the monthly AI allowance count for your account, whichever key makes the call.

What it is not

• It is not the password of an index. Searches sent straight to an index still need the username and password of that index.
• A key that may call get_core_info can read the HTTP password of the indexes it may touch. The Opensolr modules need it to connect.