Skip to main content
Use Settings → Developer → API keys to give a script or service its own identity. Members can create credentials. The page lets creators rotate their own credentials and lets creators or organization admins revoke them. A credential can access only the workspaces granted to its identity.

​
Create a credential

  1. Open API keys and select New API key.
  2. Enter a name that identifies the workload, such as release-publisher.
  3. Choose API key for scripts and CI, or Client secret for a service that requests OAuth access tokens.
  4. For an API key, choose its expiry. Client secrets have no expiry in this form and must be revoked when they are no longer needed.
  5. Select Read only or Read and write. Choose a workspace and the role the form permits for that access level.
  6. Select Create key. Copy the credential from the reveal dialog into your secret manager. Atlan shows the value once.
If the credential was created but its workspace grant failed, the page reports that partial result. Fix the grant from the credential’s details or the workspace’s member list; do not create a second credential to retry the grant. Credential scopes and workspace roles both limit access in the Gateway’s default configuration. A scope limits what the credential may do; a workspace role determines where it may do it. Read only offers the Viewer role in this form. A valid key or a write scope alone grants no workspace access.

​
Review workspace access

Open a credential’s row to review its details and workspace grants. Add only the workspaces it needs. A credential created without a workspace has no grant to that workspace’s content. See Manage workspace members. Use the credential as documented in API authentication. An API key is a bearer credential; a client ID alone is not. Never put the revealed value in a repository, URL, screenshot, or support message.

​
Rotate or revoke

For a credential you created, use the row’s Rotate action to obtain a replacement and copy it from the reveal dialog. Rotation invalidates the previous credential. Update the workload’s secret store immediately and verify a read in its intended workspace. Use Revoke an API key when the workload is retired or the credential is exposed.