API keys

Your company holds one API key, and everything uses it: the AI features of DataMind OS, the software download when you install or update it on your own servers, and your own applications' calls to the API. You manage the key on the API key card in Settings; a new company creates its first key in the setup wizard (Finish company setup).

The key card

The card is headed API key and shows the key's name and the start of its secret:

Element	What it shows
Active / None	Whether the company has an active key.
Last used	The last AI request served with the key. It reads Never until the first one.
Created	When the key was created.
Limit	The rule the card states: One active key per company.

With no active key, the card reads "No active key yet." and offers Create key. A Viewer sees "No active key. Ask an administrator to create one." instead. With a key active, Rotate and Revoke appear when you hover over the card or move focus to it.

If an action cannot complete, the console reports Create failed, Rotate failed or Revoke failed. Try the action again; if it keeps failing, contact DataMind support.

Create a key

On the API key card, click Create key.
In New API key, enter a Name, such as Production server, and click Create key. The dialog states: "Name the key so you can identify it later." The name can be up to 100 characters; leaving it empty shows "Name is required".
In API key created, copy the secret and store it where your team keeps secrets. Click Done.

Important

The secret is shown once, in the API key created and API key rotated dialogs: "Copy it now - it is shown once and cannot be recovered." Afterwards the card keeps only the start of the secret, and the full secret cannot be shown again.

If you close New API key while its name is unsaved, the console first asks Unsaved Changes: "You have unsaved changes. If you close, your changes will be lost." Choose Discard & Close to leave without creating anything, or Keep Editing to go back.

Rotate a key

Rotating replaces the secret and keeps the key, its name and its history.

Hover over the key card and click Rotate.
The confirmation Rotate <name>? states: "The current secret stops working immediately and a new one is issued." Confirm with Rotate.
Copy the new secret from API key rotated, then update every place that used the old one: DataMind OS under Administration → AI Configuration, the DataMind Installer on your servers, and your applications. Click Done when you are finished.

Anything still sending the old secret is refused until it sends the new one.

Revoke a key

Revoking switches the key off for good.

Hover over the key card and click Revoke.
The confirmation Revoke <name>? states: "This permanently disables the key. Applications using it will lose access." Confirm with Revoke.
The toast reads API key revoked. The card then shows no active key, and Create key returns.

Revoking is permanent: the key cannot be restored, and a revoked key cannot be rotated. DataMind OS loses its AI features and cannot be installed or updated, and your applications lose access, until a new key is in place.

Both actions stop the current secret at once; they differ in what is left behind:

	Rotate	Revoke
The secret	A new secret is issued; the old one stops working immediately.	The key is disabled permanently.
The key	Keeps its name; only the secret changes.	Ends, and Create key returns so you can replace it.
Afterwards	Paste the new secret everywhere the old one was used.	Create a new key and paste it everywhere the old one was used.

Who can manage keys

Every member can see the card. Managing the key needs permissions: viewing requires View API Keys, and creating, rotating and revoking are separate grants. In the built-in roles, an Administrator can create, rotate and revoke; a Viewer sees the card without the buttons.

Questions, answered

Can our company have more than one API key?

No. The card states the rule: One active key per company. To change the secret, rotate the current key; to end the key, revoke it, which frees the slot and brings back Create key.

I lost the secret. Can I see it again?

No. The secret is shown once, in the API key created or API key rotated dialog, and it cannot be shown again. Click Rotate to issue a new secret, then update DataMind OS and your applications.

What do I update after I rotate the key?

Every place that used the old secret: DataMind OS under Administration → AI Configuration, the DataMind Installer on your servers, and your applications. The old secret stops working immediately, so anything still sending it is refused.

Can I undo a revocation?

No. Revoking is permanent, and a revoked key cannot be rotated. Create a new key instead: the card offers Create key once the old key is revoked, and your applications work again when they send the new secret.

Why can't I create or change the key?

Managing the key needs permissions a Viewer does not hold. Viewing requires View API Keys, and creating, rotating and revoking are separate grants; in the built-in roles only an Administrator has them. A Viewer sees the card without the buttons.

Why does Last used say Never?

No AI request has been served with the key yet. It stays Never until the first one; installing or updating DataMind OS software does not change it.

Do DataMind OS and my applications use the same key?

Yes. The company holds one key. DataMind OS uses it for its AI features and to download its software when you install or update it on your own servers, and your applications send it in the x-api-key header (Use the API). There is no separate key per product or per person.

Is a key created if I close New API key early?

No. Nothing is created until you click Create key in the dialog. If you typed a name and close it, the console asks Unsaved Changes first: Discard & Close leaves without saving anything, Keep Editing returns to the dialog.