API Keys

An API Key is a technical account: an autonomous principal, independent of any user, that lets an external tool (third-party software, automation, deployment tool) interact with WakaStart without going through the web interface. It is not associated with a user account — it carries its own access levels and its own profile.

When do you use this section?

• You want to connect an external tool to WakaStart (deployment tool, monitoring software, automation script)
• You need to create a technical account with limited rights for a specific integration, on a given tenant and environment
• You want to view or revoke existing keys

Important: the full key is only visible once, immediately after its creation. Copy it and store it safely before closing the window.

Accessing the API key list

From the main menu on the left, click Applications then API Keys. Existing keys are displayed as cards (not a table): each card shows the name and its status, the masked key (prefix followed by dots), the creation/last used/expiration dates, the targeted Customer and environment, the profile and access levels carried by the key, HDS roles where applicable, and access restrictions (allowed IPs, request limit).

Creating an API key (technical account)

1. Click + New key at the top right. The window specifies that this is an autonomous principal, independent of any user.
2. Fill in the required information, in order:
   • Customer (tenant): the customer organization for which the key is created
   • Application: the application the key will grant access to
   • Environment: the targeted environment (prod, staging, dev...)
   • Key name: a descriptive label to identify it (e.g., "Monitoring tool connection")
   • Description (optional)
3. Define the key's rights (optional but recommended):
   • WakaStart Profile: the key inherits the rights of a profile from the WakaStart platform application, not from the customer application selected in the previous step — this field never lists profiles specific to the chosen Application
   • Admin Level / User Level: the access levels carried by the key itself
   • HDS Roles: check the applicable roles if needed
4. Add security restrictions if needed (optional):
   • Expiration date: the key will be automatically invalidated on this date
   • Allowed IP addresses: restrict the key's use to certain addresses or network address ranges
   • Request rate limit per minute: protects against abuse (0 = no limit)
5. Click Create.

The key is displayed only once in a window. Copy it immediately.

Revoking an API key

Click the trash icon next to the key. Revocation is immediate and irreversible.

Going further

• Manage profiles and rights
• View audit logs