Skip to main content
Create and revoke API keys for your Cube organization.

​
Personal API keys

Only admins can hold API keys unless you turn on Allow all users to create API keys on the Admin → Settings page. With it on, every user reaches Admin → API Keys and manages their own keys there — an admin still sees every key in the account, while everyone else sees only theirs. A personal key carries exactly its owner’s permissions, so it never reaches data or settings its owner can’t reach in the app, and it can only be scoped to deployments its owner has access to. Those permissions are what keeps a personal key narrower than an admin’s, so the switch can only be turned on while your account enforces roles and permissions. Turning it back off doesn’t delete existing personal keys, but it stops them authenticating: every request made with one is rejected with 403 Forbidden until it’s turned on again. Endpoints that act on behalf of someone else still require an admin’s key — generating an embed session is the main one.

​
Deployment scope

By default, an API key is not scoped to any deployment—it can be used with every deployment in your organization (the All deployments option). When creating or editing a key, you can instead scope it to one or more specific deployments. The scope determines which requests a key can authorize:
  • Deployment-scoped endpoints—such as generating an embed session for a deployment—require the key to be scoped either to that deployment or to all deployments. A request targeting a deployment outside the key’s scope is rejected.
  • Endpoints that aren’t tied to a specific deployment continue to work with any key, regardless of its scope.
Each key’s scope—All or the specific deployments it’s limited to—is shown in the API keys table.
Scoping is optional and backward compatible. Existing keys remain unscoped (All deployments) until you change them.