Desktop, External, Internal, or Custom. Choose the type that matches the integration.

Only applies to Custom, External, and Internal. This field is not shown for Desktop keys.

The date and time when the system automatically disables the key; the key is deleted seven days after expiry. Leave empty for no expiry.

Purpose of the key (free text).

When selected, the key is active and available for use. Keys are enabled by default.

For Custom API keys only. Choose the tenant on whose behalf you are creating the API key. The key can be used to access the specified tenant's data.

For External and Custom keys only. Choose All users or Specific user.

All users

• Gives full access to all features and APIs.

• Typically used for system-wide integrations or services that need broad access.

• Security risk is Higher, since it grants universal access.

Specific user

• Limits access to the permissions of the assigned user, at the time of use, not just at creation.

• While technically usable by anyone, it is intended to be used only by the assigned user.

• Security benefits:

  • Aligns with PCI DSS 4.0 and other security standards.

  • Reduces risk by limiting access scope.

  • Easier to audit and manage user-specific access.

For Custom key only. Add allowed resources by specifying GET or POST and the API endpoints. Supports wildcard (*).

Example: Properly formatted URLs:

• /api/qm/export

• /api/audit/export

• /api/audit/*

To delete an entry, select the row you want to delete, and then select the Delete () icon.