Glossary
What is API key?
An API key is a secret code that a system uses to identify itself to an API. Treat an API key like a password: store it securely and replace it if it leaks.
API key explained
A system sends the API key with every request, usually in a header. The API checks the key and uses it to know who is asking and what they may do. It is a simple form of authentication, well suited to connections between systems.
An API key only says which system is asking, not which person is behind it. For access on behalf of a user, OAuth tokens are often used, which are valid for a shorter time and carry per-user permissions. For a fixed connection between two systems, an API key is often enough.
Never put a key in code that is public, such as a Git repository or a website's source code. Use a separate key per consumer, so you can revoke one without affecting the rest, and replace a key immediately if you suspect it has leaked.
Example
Acme Groothandel's planning system and reporting tool each get their own API key. When the reporting tool is retired, the administrator revokes only that key, and the planning system keeps working.
API key in ENABLE
In ENABLE every Data API endpoint has its own API key, sent in the X-API-Key header. ENABLE shows the key once and stores only a hash; a key that has leaked or been lost is replaced with a new one.
FAQ
Frequently asked questions
What is the difference between an API key and a password?
A password belongs to a person; an API key belongs to a system or connection. Both are secret and must be stored securely.
What is the difference between an API key and OAuth?
An API key is a fixed secret code that identifies a system. OAuth works with temporary tokens issued on behalf of a user, with per-user permissions.
What should you do if an API key leaks?
Revoke the key immediately and create a new one for the system that uses it. Then check the logs for unusual requests.
Further reading
- PlatformData API: expose your data warehouse via RESTPublish a query as a secure REST endpoint for other systems and apps.Read more
- PlatformPower BI row-level security and dashboard accessAccess profiles, Power BI row-level security, two-factor authentication and an audit log.Read more
- SolutionAI agents for business: start with secure dataAI agents start with secure, limited data access. This is how ENABLE lays that foundation.Read more
- ResourcesGlossary of data, AI and Power BI termsWhat is a service principal, row-level security, a semantic model, text-to-SQL or RAG? Short, clear definitions of terms around data, Power BI and AI.Read more
Use AI on your own data. Securely, and without the headache.
In an online demo we show how ENABLE makes your data securely available and how you build on it: describing an app in the AI Builder, plain-language questions, dashboards and APIs. And how we set it up and manage it for you.