Use API Keys to Control Access in Confluent Cloud¶

Confluent Cloud API keys are used to control access to Confluent Cloud components and resources. Each API key consists of a key and a secret. For details about using user and service accounts and their ownership of API keys, see Ownership of API keys.

Use the resource API keys to control access to Confluent Cloud components and services. Here are the API keys for Confluent Cloud components:

Resource API key	Description
Kafka	Required to access your Kafka clusters and Kafka resources. Each Kafka API key is valid for one specific Kafka cluster.
Schema Registry	Required to access the Confluent Cloud Schema Registry. Each Schema Registry API key is valid for one specific Schema Registry.
ksqlDB	Required to interact with your ksqlDB applications in Confluent Cloud. Each ksqlDB API key is valid for one specific ksqlDB application.
Flink	Required To manage Flink workoads programmatically in Confluent Cloud for Apache Flink®️. You can create API keys for user accounts and service accounts.

Use Cloud API keys to control access to Confluent Cloud resources and use the Confluent Cloud APIs available for environments, user accounts, service accounts, connectors, Metrics API, and other resources.

To create and manage API keys in Confluent Cloud, you can use the following tools:

For recommendations on using API keys, see Best Practices for Using API Keys in Confluent Cloud.

Ownership of API keys¶

Each API key is associated with a specific service account or user account. The limit on the number of API keys that can be associated with user or service accounts is specified in Service Quotas for Confluent Cloud.

A best practice is to create separate service accounts associated with an API keys for each applications or use case.
Using API keys associated with a user account is not recommended for production environments, but can be used for development and testing. If you use an API key associated with a user account, the API key inherits the permissions of the user account. If the user account is deleted, the API key is also deleted.
API keys are immutable and cannot be modified. If you need to change the permissions associated with an API key, you must delete the key and create a new one.
Access control lists (ACLs) and role bindings are associated with principals, not with API keys. For details, see Role-based Access Control (RBAC) in Confluent Cloud and Use Access Control Lists (ACLs) for Confluent Cloud.
Restrict access to an application that uses an API key associated with a service account:
- For resource API keys, you can use role-based access control (RBAC) and access control lists (ACLs).
- For Cloud API keys, use role-based access control (RBAC).

Caution

When you delete a user account or service account, all associated API keys will also be deleted. Any client applications using a deleted API key will lose access, which may cause an outage for your streaming application. Always confirm that none of the API keys owned by an account are in active use before deleting a user or service account.

Resource API keys¶

Use the resource API keys to control access to specific Confluent Cloud components and services. Resource API keys are available for Kafka, Schema Registry, and ksqlDB resources.

Each resource API key is valid for one specific resource — one Kafka cluster, one Schema Registry, or one ksqlDB application.

Important

Resource API keys propagate quickly after creation, usually within a few minutes. If you try to use an API key before propagation completes, authentication failures occur. Depending on workloads, you might need to wait a few minutes more and try again.

Create a resource API key¶

You can create resource API keys for Kafka clusters, Schema Registry, and ksqlDB applications.

Prerequisites

Access to Confluent Cloud with an active cluster.
Confluent CLI is installed.
To create resource API keys, you must be granted one of the following roles: OrganizationAdmin, EnvironmentAdmin, CloudClusterAdmin, Operator, ResourceOwner. DeveloperManage. DeveloperRead, or DeveloperWrite. An API key created with an RBAC role has the same permissions as the principal that created the key. For details, see Predefined RBAC roles in Confluent Cloud.

Verify that you have any required access control lists (ACLs) for the service account.

Important

You cannot use Confluent Cloud Console to associate a resource key with a service account.

For Schema Registry and ksqlDB, no access control is available.

Sign in to your cluster using the confluent login CLI command.

confluent login

Enter your Confluent Cloud credentials:
Email: susan@myemail.com
Password: ********

Get the resource ID (<resource-id>) for Kafka, Schema Registry, or ksqlDB. To find the resource ID, use the following Confluent CLI commands:
- Kafka: confluent kafka cluster list
- Schema Registry: confluent schema-registry cluster describe
- ksqlDB: confluent ksql cluster list

Create the API key and secret using the confluent api-key create command.

confluent api-key create --service-account <service-account-id> --resource <resource-id> --description "prod key"

Save the API key and secret in a secure location. The secret cannot be retrieved later.
Use the confluent api-key use command to specify the API key and secret you will be using with Confluent CLI commands on the resource. For Schema Registry resources only, you do not need to specify the API key to use.
```
confluent api-key use <api-key>
```

Prerequisites

Access to Confluent Cloud. Sign in with an active cluster. Log in to Confluent Cloud at https://confluent.cloud.
To create resource API keys, you must be granted the OrganizationAdmin, EnvironmentAdmin, or CloudClusterAdmin role. For details, see Predefined RBAC roles in Confluent Cloud.

Verify that you have any required access control lists (ACLs) for the service account.

Important

Before creating a Kafka API key associated with a service account, you must have an ACL that restricts access. If you do not have an ACL configured, the API key will not have access.

For Schema Registry and ksqlDB, no access control is available.
If you have more than one environment, go to the Environments page at https://confluent.cloud/environments and select the environment.
Select the Confluent Cloud resource you want to create an API key for (Kafka or Schema Registry). For ksqlDB API keys, you need to use the Confluent CLI — see the Confluent CLI tab in this section.
- Kafka cluster: In the Cloud Console, click the cluster and then under Cluster Overview, click API Keys.
- Schema Registry: In the Cloud Console, click the Schema Registry tab, find the API credentials section, click Edit, and then Create key.
If this is the first API key for the resource, click Create key. If API keys already exist, click + Add key.

The API key and secret are generated and displayed.
Click Copy to copy the key and secret to a secure location.

The secret for the key is only displayed in the Create API key dialog and cannot be viewed or retrieved later. Store the API key and secret in a secure location. Do not share the secret for your API key.
(Optional, but recommended) Enter a description of the API key that describes how you intend to use it, so you can distinguish it from other API keys.

Specifying which API key to use is not necessary for Schema Registry resources.
Confirm that you have saved your key and secret.
Click Continue. The key is added to the API keys table.

You can search for API keys, add or delete keys, and edit descriptions of keys on the appropriate API Access tab.

Edit a resource API key description¶

Follow the procedures below to add, edit, or delete the optional description of an API key.

To edit the description of a resource API key, use the confluent api-key update command.

confluent api-key update <api-key> --description <description-string>

Delete a resource API key using the Confluent Cloud Console¶

You should delete API key if it no longer needed or if its secret is compromised.

Warning

When a resource is deleted, associated API keys are also deleted.

From the appropriate API Access tab for the Kafka, Schema Registry, or ksqlDB resource, select the key that you want to delete.
Click the trash icon. The Confirm API key deletion dialog appears.
Click Confirm.

Caution

The delete API key action cannot be undone.

Create a Kafka API key associated with a user account¶

You can create a new Kafka API key and associate it with an existing user account.

Navigate to the cluster in which you want to create a Kafka API key.
Click the API access tab, and then click +Add key.
Select Create an API key associated with your account. When you specify this option, the new API key will inherit the same access permissions that are already specified for your existing user account.
Enter a description, save your API key and secret in a safe place, and select the checkbox indicating you have saved the key and secret. Click Save.

Cloud API keys¶

Use Cloud API keys to control access to Confluent Cloud resources and use the Confluent Cloud APIs available for environments, user accounts, service accounts, connectors, Metrics API, and other resources.

Important

Cloud API keys are scoped to your entire organization, not just to a specific resource.

Create a Cloud API key¶

Prerequisites

Access to Confluent Cloud.
Confluent CLI is installed.
To create Cloud API keys, you must be granted the OrganizationAdmin. For details, see Predefined RBAC roles in Confluent Cloud.

Sign in to your cluster using the confluent login command.

confluent login

Enter your Confluent Cloud credentials:
Email: susan@myemail.com
Password: ********

Before creating an Cloud API key associated with a service account, use RBAC to restrict access to applications that use the key.
Create the Cloud API key using the confluent api-key create command, specifying the resource (--resource) as cloud. By default, this associates the key with your user account. If you want to associate the key with a service account instead, specify the service account flag (--service-account). A description (--description) is optional but recommended.
```
confluent api-key create --resource cloud --description <key-description> --service-account <service-account-id>
```
Save the API key and secret output in a secure location. The secret is not retrievable later.

Important

When you remove a user’s role assignment on a cluster for which the user created an API key, then the API key will continue to work even after the user’s role assignment has been removed. For example:

Bob has the OrganizationAdmin role.
Bob creates an API key for cluster_1 in the Prod_1 environment.
Bob’s roles are updated, and he no longer has the OrganizationAdmin role in Prod_1. Now he is assigned the EnvironmentAdmin role for the Dev_1 environment.
The API key that Bob created continues to work for cluster_1.

In such cases, if the API key allows unintended access, you must delete it:

# List the API keys for ``cluster_1``
confluent api-key list --resource lkc-123456
# Delete the API key that Bob created for ``cluster_1``
confluent api-key delete <api-key>