Generate and manage Auvik API keys

What you can create

Each Auvik user can have one active API key.

If separate keys are needed for different systems, environments, or teams, create separate Auvik user accounts. Dedicated service accounts are recommended for integrations.

Generate an API key

1. From the side navigation bar, click your username.
2. Open your profile settings.
3. Click Generate API Key.
4. Copy the API key and store it securely.
5. Click Done.

The full API key is shown only when it is generated or regenerated.

If you do not see the option to generate an API key, contact an administrator to confirm your role and permissions or to create a dedicated service account.

API key permissions and site access

An API key inherits the permissions of the Auvik user who created it.

The sites, clients, tenants, and API endpoints available through the key depend on:

• The user’s assigned role.
• The API permissions included in that role.
• The sites or clients assigned to the user.
• The API family and endpoint being used.

If your integration must access multiple sites or clients, confirm that the account behind the API key has access to each required environment.

Use separate keys for separate systems

Create separate service accounts when different systems or environments require independent access or rotation.

Examples include:

• Production and test environments.
• Different integration platforms.
• Separate customer or site groups.
• Different internal teams.

This makes it easier to limit access, audit usage, and rotate one key without interrupting unrelated systems.

Regenerate an API key

Regenerating an API key immediately invalidates the previous key.

Before regenerating:

1. Identify every integration, script, scheduled job, or tool using the current key.
2. Create or confirm a secondary service account if continuity is required.
3. Regenerate the API key.
4. Copy and securely store the new key.
5. Update every integration that uses the old key.
6. Test the integrations.
7. Confirm that the old key is no longer being used.

Revoke an API key

1. From the side navigation bar, click your username.
2. Click Revoke.
3. Confirm the revocation.

Revoking a key stops any integrations that use it. Confirm that the key is no longer required before revoking it.

How user roles and account status affect API key access

An API key is bound to the Auvik user who created it. The key can perform only the actions allowed by that user’s role and access to specific clients, sites, or tenants.

If the user’s role or site access changes, the key’s effective permissions change as well.

Before disabling or removing a user

Before deactivating or removing a user who owns an API key:

1. Identify every integration, script, scheduled job, or tool using the key.
2. Create or confirm a dedicated service account for the integration.
3. Assign the required role and site access to the service account.
4. Generate a new API key.
5. Update and test all integrations.
6. Deactivate or remove the original user only after the replacement is working.

Disabling or removing the owning user may cause the API key to stop working.

Common symptoms

If an integration returns 403 Forbidden after a role or team change:

• Confirm that the user still has the required role.
• Confirm that the user still has access to the required clients, sites, or tenants.
• Verify that the role includes permissions for the endpoint being called.
• Check whether the user account was disabled or removed.
• Generate a new key under an active, correctly scoped service account if necessary.

If an integration connects but returns less data than expected, verify that the user’s role still includes read access to the required resources and that the user still has access to all expected sites or clients.

Operational checklist

• Maintain a record of which integrations use each service account and key.
• Document the clients, sites, tenants, and endpoints each integration requires.
• Review service-account roles quarterly and after staffing changes.
• Test replacement or fallback credentials in a non-production environment.
• Rotate or replace keys before deprovisioning the owning user.

Security best practices

• Use dedicated service accounts instead of personal accounts for integrations.
• Grant only the role permissions required by the integration.
• Limit the account to the sites and clients it needs.
• Store API keys in a secure secrets manager.
• Do not commit API keys to code repositories.
• Do not share API keys through email, chat, tickets, or screenshots.
• Rotate keys regularly and whenever team membership or integration ownership changes.
• Document which integrations use each key.
• Update and test all integrations immediately after rotating a key.