Skip to main content

Manage API Keys

After creating environments (on-demand creation or pre-creation and allocation), you need to issue an access credential — an API Key — for each user's (employee, customer, tenant) environment.

Under Platform Edition, CloudBase provides API Key as the environment access credential: the API Key is bound to a specified environment ID by the CloudBase platform and strictly validated on the server side. The permission is always limited to the scope of this environment. Even if leaked, it can only access that user's own environment, and cannot laterally access other users' environment data. API Key is the only recommended environment access method in Platform Edition scenarios.

Integration Overview​

The entire Platform Edition integration consists of three steps:

  1. Purchase and create environments: purchase the Platform Edition package, see Purchase and Initialization; create environments (on-demand creation or pre-creation), see Create Environments
  2. Manage API Keys: issue an API Key for each environment and deliver it to users (this document)
  3. Connect environments with API Key: users configure the API Key in the Agent tool to operate their own environments, see Connect environments with API Key

The overall flow is as follows:

Security Baseline​

Under Platform Edition, API Keys follow the least privilege + per-environment isolation principle, and are constrained by a platform-built-in security baseline that cannot be modified or bypassed:

  • Cannot delete environments
  • Cannot view / generate / revoke API Keys
  • Can only operate the resources of the environment itself

Even if a key is leaked, it can only operate the resources of that environment: it cannot delete environments, cannot read or write other API Keys, and cannot access other environments' data.

After creating environments with the account's SecretId / SecretKey via the Cloud APIs, the platform simply creates an API Key for each environment.

Create an API Key​

Call the Tencent Cloud CreateApiKey API to create an api_key type key for a user environment. See the API documentation for specific parameters:

// Example: create an API Key for a user environment
const result = await tcbClient.CreateApiKey({
  EnvId: userEnvId, // the user's CloudBase environment ID
  KeyType: "api_key", // server-side admin-level key
  KeyName: `user-${userId}`,
  // ExpireIn: 7776000    // Optional: validity period (seconds); if omitted, no expiration
});
// result.ApiKey is the plaintext of the key. It is only returned once, so save it securely.

Create Manually in the Console​

You can also create it manually in the console: CloudBase Console → Environment → API Key Management.

Deliver to Users​

The platform delivers CLOUDBASE_ENV_ID and CLOUDBASE_API_KEY to the corresponding users through its own channels (site messages, emails, etc.). Users fill in the environment ID and API Key in the MCP configuration of their Agent tool to directly operate their own CloudBase environment, without any additional login flow.

Security Notes​

Security tips

api_key has read/write permissions on the resources of this environment. It can be provided to users through secure channels for local MCP configuration, or stored only on the platform server side; do not write it into business frontends, browser-executable code, application code repositories, or public channels. It is recommended to rotate it regularly. A maximum of 5 keys can be created per environment.

Next Steps​

After completing API Key management, you can connect the environment to your Agent platform:

→ Connect environments with API Key