Skip to main content

API Key Management

The API Key Management feature allows administrators to create and manage systems that own API keys for tenant integration with external applications. Each system represents a registered client application that needs to authenticate with the Consentrix API.

Prerequisites​

Before you begin, ensure you have:

  • An active Consentrix Account.
  • Appropriate permissions to manage API keys (see Required Permissions).

Required Permissions​

Permission CodeAccess
api_key_management:viewView systems and API keys
api_key_management:createCreate systems and generate API keys
api_key_management:editEdit system name and revoke API keys
api_key_management:deleteDelete systems

Key Features​

FeatureDescription
Create SystemCreate a new system API entry for the tenant
Edit SystemModify system name
Generate API KeyGenerate a secure API key (shown only once for security)
Revoke API KeyInvalidate an existing API key
Delete SystemRemove a system and its API key
SearchFilter systems by name
  1. Log in to the Consentrix platform.
  2. Go to Administration > API Key Management.

You will see a list of all systems for your tenant with their names, API key marks (last 4 characters), and last updated timestamps.

API Key Management List

Create a New System​

A System is a registered API client that will own an API key for authenticating with the Consentrix API.

Steps​

  1. On the API Key Management page, click Create API key.
  2. On the Create System page:
    • Enter a unique System Name (e.g., mobile-app-ios, checkout-service, crm-integration).
  3. Click Submit.
  4. You will be redirected to the System Detail page.

Create System Page

Tip: Use descriptive names that indicate the application or service using the API key. This helps with identification and auditing.

View System Details​

The System Detail page displays information about a specific system:

FieldDescription
System NameName of the system
API Key MarkLast 4 characters of the API key (or "Not generated")
Last UpdatedTimestamp of last modification

From this page, you can:

  • Manage API Key (generate or revoke)
  • Edit the system name
  • Delete the system

System Detail Page

Manage API Key​

From the System Detail page, click Manage API Key to navigate to the API key management page.

Manage API Key Page

Generate an API Key​

Once a system is created, you can generate an API key for it.

Steps​

  1. From the Manage API Key page, click Generate API Key.
  2. A dialog will appear displaying the full API key and its mark (last 4 characters).
  3. Important: Copy the API key immediately and store it securely. The full key is only shown once for security purposes.
  4. Click Close on the dialog.

Generate API Key Dialog

What happens next​

  • The API key mark (e.g., ••••••••••••abcd) will be visible in the system list for identification.
  • The full API key cannot be viewed again. If lost, you must revoke and generate a new one.

Security Best Practices​

  • Store the API key in your application's secrets manager
  • Never hard-code the API key in source code or commit it to a repository.
  • Use separate systems for separate applications — do not share one key across multiple services.

Edit a System​

You can modify the name of an existing system.

Steps​

  1. From the API Key Management list, click View on the system you want to edit.
  2. On the System Detail page, click Edit.
  3. Modify the System Name as needed.
  4. Click Save.
  5. Confirm the changes.

Edit System Page

Revoke an API Key​

Revoking an API key immediately invalidates it. Use this when you suspect a key has been compromised or when an application is no longer active.

Steps​

  1. From the Manage API Key page, click Revoke API Key.
  2. A confirmation dialog will appear explaining that the current API key will no longer be usable.
  3. Click Confirm to revoke the key.

Revoke API Key Dialog

Note: After revocation, the system will show "Not generated" as the API key mark. You can generate a new key if needed.

Delete a System​

Deleting a system permanently removes it and its API key from the system.

Steps​

  1. From the System Detail page, click Delete System.
  2. A confirmation dialog will appear.
  3. Click Confirm to delete the system.

Delete System Dialog

Warning: This action cannot be undone. Ensure no applications are using the system's API key before deletion.

Search for Systems​

You can filter the system list by name:

  1. In the search bar at the top of the API Key Management page, enter part or all of a system name.
  2. The table will filter to show matching systems.
  3. Clear the search to view all systems.

Best Practices​

System Naming Conventions​

Use clear, descriptive names that indicate the application or service:

Good ExamplesAvoid
mobile-app-iosapp1
checkout-serviceapi
crm-integrationsystem

API Key Security​

  1. Store Securely: Save API keys in your application's secrets manager or environment variables.
  2. Never Commit: Do not hard-code API keys in source code or commit them to repositories.
  3. One Key Per Service: Create separate systems for each application — do not share keys across services.
  4. Rotate Regularly: Revoke and regenerate keys periodically or when team members leave.
  5. Monitor Usage: Use the Audit Log to track API key activities and detect unusual patterns.

Lifecycle Management​

  1. Document Systems: Maintain an internal registry of systems and their purposes.
  2. Review Periodically: Audit systems regularly and delete unused ones.
  3. Revoke Promptly: Immediately revoke keys for decommissioned applications.

Troubleshooting​

"Generate API Key" button is disabled​

  • An API key has already been generated for this system. To create a new key, revoke the existing one first.

"Revoke API Key" button is disabled​

  • No API key has been generated for this system yet.

Cannot see "Create API key" button​

  • Your user account does not have the api_key_management:create permission. Contact your administrator.