Manage API keys

The API key management page of the Clovis administration console brings together the API keys for the selected organization. It lets you monitor their consumption and manage their lifecycle.

Check the selected organization

If your account provides access to multiple organizations, check the selector in the top left before creating or changing a key. Changes apply to the organization currently displayed.

View and find a key

The total number of keys appears next to the API keys heading. The table shows the following information for each key:

Column	Information displayed
Alias	Name identifying how the key is used, together with a masked fragment of the key.
Owner	Person or team associated with the key.
Tokens	Number of tokens consumed by the key.
Created on	Date the key was created.
Status	Current state of the key, for example Active.
Action	Menu providing access to the operations available for the key.

Use the Search by alias or owner field to filter the list. When the number of results exceeds one page, use the pagination controls below the table.

Create a key

1. Select Create key.
2. In Key alias, enter a short suffix that clearly describes the application, environment, or intended use. The full name displayed includes the prefix added by the console.
3. In Owner email, select an existing user or enter the business email address of the person responsible. If they do not yet exist in Clovis, an account is created for that address.
4. Check the full name and owner, then select Create key.
5. Share and store the key according to your organization’s security policies.

Protect the key value

An API key is a secret. Never include it in source code, documentation, a screenshot, a ticket, or an unsecured message. Store it in a secrets manager and replace it immediately if it has been exposed.

Choose a stable, descriptive alias, such as example-production or example-ci. Avoid people’s names, and create a separate key for each application and environment to make monitoring and revocation easier.

Manage an existing key

Open the ⋮ menu in the Action column for the relevant key.

Action	Effect	Important consideration
Set a limit	Sets a maximum consumption, expressed in millions of tokens, for the selected period.	With the Lifetime period, the key permanently stops working once the limit is reached.
Protect key	Protects the key against accidental deletion.	Use this option for keys required by an important service.
Set as ChattyBot	Assigns the key to the ChattyBot service.	Check the alias and owner before confirming the assignment.
Block key	Immediately disables the key so that it can no longer be used.	Applications that use it encounter authentication errors as soon as it is blocked.
Delete	Permanently deletes the key.	This action cannot be undone. First check that no service still depends on the key.

Set a token limit

1. Select Set a limit.
2. Enter the limit in millions of tokens.
3. Choose one of the available periods.
4. Read the effect described in the window, then select Save.

Then monitor the Tokens column to anticipate when the limit will be reached.

Protect a key

1. Select Protect key.
2. Check the alias displayed in the confirmation window.
3. Select Protect.

Protection reduces the risk of accidental deletion. It does not replace a consumption limit or the blocking of a compromised key.

Assign a key to ChattyBot

1. Select Set as ChattyBot.
2. Check the displayed alias.
3. Select Set.

The key is then used by the ChattyBot service.

Block a key

1. Select Block key.
2. Check the alias and the impact on dependent applications.
3. Select Block.

Block a key when you suspect it has been exposed or need to stop its use immediately.

Delete a key

1. Confirm that the key is no longer in use and that no application depends on its value.
2. Select Delete from the actions menu.
3. Check the alias displayed in the confirmation window.
4. Select Delete.

Deletion cannot be undone. To stop use immediately while you investigate, block the key first.

Key management best practices

• assign an identifiable owner to each key;
• use a separate key for each application and environment;
• set a limit appropriate for the expected usage;
• protect essential keys against accidental deletion;
• regularly monitor consumption and block unused keys;
• delete a key only after checking that no service depends on it;
• never publish the value or a recognizable fragment of a key.

Visibility depends on permissions

The keys, organizations, and actions available depend on the permissions assigned to your account.