Use API Keys to Control Access

Confluent Cloud API keys are used to control access to Confluent Cloud components and resources. Each API key consists of a key and a secret. For details about using user and service accounts and their ownership of API keys, see Ownership of API keys.

Use the resource-specific API keys to control access to Confluent Cloud components and services. Here are the API keys for Confluent Cloud components:

Resource-specific API key Description
Kafka Required to access your Kafka clusters and Kafka resources. Each Kafka API key is valid for one specific Kafka cluster.
Schema Registry Required to access the Confluent Cloud Schema Registry. Each Schema Registry API key is valid for one specific Schema Registry.
ksqlDB Required to interact with your ksqlDB applications in Confluent Cloud. Each ksqlDB API key is valid for one specific ksqlDB application.

Use Cloud API keys to control access to Confluent Cloud resources and use the Confluent Cloud APIs available for environments, user accounts, service accounts, connectors, Metrics API, and other resources.

To create and manage API keys in Confluent Cloud, you can use the following tools:

For recommendations on using API keys, see Best Practices for using API Keys.

Ownership of API keys

Each API key is associated with a specific service account or user account. The limit on the number of API keys that can be associated with user or service accounts is specified in Service Quotas for Confluent Cloud.

  • A best practice is to create a separate service accounts associated with an API keys for each applications or use case.
  • Restrict access to an application that uses an API key associated with a service account:

Caution

When you delete a user account or service account, all associated API keys will also be deleted. Any client applications using a deleted API key will lose access, which may cause an outage for your streaming application. Always confirm that none of the API keys owned by an account are in active use before deleting a user or service account.

Resource-specific API keys

Use the resource-specific API keys to control access to specific Confluent Cloud components and services. Resource-specific API keys are available for Kafka, Schema Registry, and ksqlDB resources.

Each resource-specific API key is valid for one specific resource — one Kafka cluster, one Schema Registry, or one ksqlDB application.

Important

Resource-specific API keys propagate quickly after creation, usually within a few minutes. If you try to use an API key before propagation completes, authentication failures occur. Depending on workloads, you might need to wait a few minutes more and try again.

Create a resource-specific API key

You can create resource-specific API keys for Kafka clusters, Schema Registry, and ksqlDB applications.

Prerequisites
  1. Verify that you have any required access control lists (ACLs) for the service account.

    Important

    Before creating a Kafka API key associated with a service account, you must have an ACL that restricts access. If you do not have an ACL configured, the API key will not have access.

    For Schema Registry and ksqlDB, no access control is available.

  2. Sign in to your cluster using the confluent login CLI command.

    confluent login
    
    Enter your Confluent Cloud credentials:
    Email: susan@myemail.com
    Password:
    
  3. Get the resource ID (<resource-id>) for Kafka, Schema Registry, or ksqlDB. To find the resource ID, use the following Confluent CLI commands:

    • Kafka: confluent kafka cluster list
    • Schema Registry: confluent schema-registry cluster describe
    • ksqlDB: confluent ksql app list
  4. Create the API key and secret using the confluent api-key create command.

    confluent api-key create --service-account <service-account-id> --resource <resource-id> --description <prod key>
    
  5. Save the API key and secret output in a secure location. The secret cannot be retrieved later.

    Tip

    To register an API key and secret created by another process and store them locally, run the confluent api-key store command, specifying the API key (<api-key>), API secret (<api-secret>), and resource ID (<resource-id>).

    confluent api-key store <api-key> <api-secret> --resource <resource-id>
    
  6. Use the confluent api-key use command to specify the API key and secret you will be using with Confluent CLI commands on the resource. For Schema Registry resources only, you do not need to specify the API key to use.

    confluent api-key use <api-key>
    

Edit a resource-specific API key description

Follow the procedures below to add, edit, or delete the optional description of an API key.

To edit the description of a resource-specific API key, use the confluent api-key update command.

confluent api-key update <api-key> --description <description-string>

Delete a resource-specific API key using the Confluent Cloud Console

You should delete API key if it no longer needed or if its secret is compromised.

  1. From the appropriate API Access tab for the Kafka, Schema Registry, or ksqlDB resource, select the key that you want to delete.

  2. Click the trash icon. The Confirm API key deletion dialog appears.

  3. Click Confirm.

    Caution

    The delete API key action cannot be undone.

Create a Kafka API key associated with a user account

You can create a new Kafka API key and associate it with an existing user account.

  1. Navigate to the cluster in which you want to create a Kafka API key.
  2. Click the API access tab, and then click +Add key.
  3. Select Create an API key associated with your account. When you specify this option, the new API key will inherit the same access permissions that are already specified for your existing user account.
  4. Enter a description, save your API key and secret in a safe place, and select the checkbox indicating you have saved the key and secret. Click Save.

Cloud API keys

Use Cloud API keys to control access to Confluent Cloud resources and use the Confluent Cloud APIs available for environments, user accounts, service accounts, connectors, Metrics API, and other resources.

Important

Cloud API keys are scoped to your entire organization, not just to a specific resource.

Create a Cloud API key

Prerequisites
  1. Sign in to your cluster using the confluent login command.

    confluent login
    
    Enter your Confluent Cloud credentials:
    Email: susan@myemail.com
    Password:
    
  2. Before creating an Cloud API key associated with a service account, use RBAC to restrict access to applications that use the key.

  3. Create the Cloud API key using the confluent api-key create command, specifying the service account (--service-account), the resource (--resource) as cloud, and, optionally, a description (--description).

    confluent api-key --service-account <service-account-id> create --resource cloud --description <key-description>
    
  4. Save the API key and secret output in a secure location. The secret is not retrievable later.

    Tip

    To use an existing API key and secret, run this command with the resource ID (cloud), API key (<api-key>), and API secret (<api-secret>) specified. This command registers an API key and secret created by another process and stores it locally.

    confluent api-key store <api-key> <api-secret> --resource cloud
    

Important

When you remove a user’s role assignment on a cluster for which the user created an API key, then the API key will continue to work even after the user’s role assignment has been removed. For example:

  • Bob has the OrganizationAdmin role.
  • Bob creates an API key for cluster_1 in the Prod_1 environment.
  • Bob’s roles are updated, and he no longer has the OrganizationAdmin role in Prod_1. Now he is assigned the EnvironmentAdmin role for the Dev_1 environment.
  • The API key that Bob created continues to work for cluster_1.

In such cases, if the API key allows unintended access, you must delete it:

# List the API keys owned by Bob
confluent api-key list --"Bob"
# Delete the API key that Bob created
confluent api-key delete <api-key>