Manage API Keys

After creating environments (on-demand creation or pre-creation and allocation), you need to issue an access credential — an API Key — for each user's (employee, customer, tenant) environment.

Under Platform Edition, CloudBase provides API Key as the environment access credential: the API Key is bound to a specified environment ID by the CloudBase platform and strictly validated on the server side. The permission is always limited to the scope of this environment. Even if leaked, it can only access that user's own environment, and cannot laterally access other users' environment data. API Key is the only recommended environment access method in Platform Edition scenarios.

Integration Overview

The entire Platform Edition integration consists of three steps:

Purchase and create environments: purchase the Platform Edition package, see Purchase and Initialization; create environments (on-demand creation or pre-creation), see Create Environments
Manage API Keys: issue an API Key for each environment and deliver it to users (this document)
Connect environments with API Key: users configure the API Key in the Agent tool to operate their own environments, see Connect environments with API Key

API Key Permission Model

Under Platform Edition, API Keys follow the least privilege + per-environment isolation principle. The permission is jointly determined by three layers of constraints, converging from coarse to fine:

Layer	Configured by	Scope	Constraint
System security baseline	Built into the platform, cannot be modified or bypassed	The whole platform	Cannot delete environments, cannot view / generate / revoke API Keys, can only operate the resources of the environment itself
Package-level Deny	Package administrator	All environments under the package	High-risk operations uniformly prohibited by the package (such as deleting identity sources, modifying domain configurations); API Keys of all environments cannot bypass them, deny takes precedence
Environment-level permissions	Configured when creating an API Key	A single environment	Whitelist / blacklist modes, authorizing by "feature × read/write" granularity

Even if a key is leaked, it can only operate the resources already authorized within that environment: it cannot delete environments, cannot read or write other API Keys, and cannot access other environments' data.

Permission Configuration Modes

When creating an API Key, you can choose one of the following two configuration modes:

Mode	Behavior	Suitable scenarios
Whitelist	Only grants the selected feature × read/write permissions; unselected features have no permission	Least privilege: most secure and clear when the API Key only needs access to a few features
Blacklist	Grants all feature × read/write permissions by default, and only denies the selected features	Convenient configuration: when the API Key needs most features and only a few high-risk items need to be excluded

Permissions are expressed by "feature × read/write" (for example, "Cloud Database - readable" or "Identity source - writable"); you do not need to understand the underlying APIs, and the mapping between features and APIs is maintained by the platform
In either mode, the final permissions do not exceed the package-level Deny, nor can they touch the system security baseline
The configurable feature scope (such as Cloud Database, identity sources, cloud functions, etc.) is subject to what is actually shown in the CloudBase console
Permission changes take effect within about 2 hours by default; when modifying, the temporary key cache of the API Key is cleared at the same time, so changes can take effect immediately

Create an API Key

Call the Tencent Cloud CreateApiKey API to create an api_key type key for a user environment. You can optionally fill in permission configuration (whitelist / blacklist mode and feature × read/write authorization) when creating; if omitted, default permissions are granted. See the API documentation for specific parameters:

// Example: create an API Key for a user environment
const result = await tcbClient.CreateApiKey({
  EnvId: userEnvId, // the user's CloudBase environment ID
  KeyType: "api_key", // server-side admin-level key
  KeyName: `user-${userId}`,
  // ExpireIn: 7776000    // Optional: validity period (seconds); if omitted, no expiration
});
// result.ApiKey is the plaintext of the key. It is only returned once, so save it securely.

Create Manually in the Console

You can also create it manually in the console: CloudBase Console → Environment → API Key Management.

Deliver to Users

The platform delivers CLOUDBASE_ENV_ID and CLOUDBASE_API_KEY to the corresponding users through its own channels (site messages, emails, etc.). Users fill in the environment ID and API Key in the MCP configuration of their Agent tool to directly operate their own CloudBase environment, without any additional login flow.

Security Notes

Security tips

api_key has read/write permissions corresponding to the features already authorized for this environment. It can be provided to users through secure channels for local MCP configuration, or stored only on the platform server side; do not write it into business frontends, browser-executable code, application code repositories, or public channels. It is recommended to rotate it regularly. A maximum of 5 keys can be created per environment.

Next Steps

After completing API Key management, you can connect the environment to your Agent platform:

→ Connect environments with API Key

Integration Overview​

API Key Permission Model​

Permission Configuration Modes​

Create an API Key​

Create Manually in the Console​

Deliver to Users​

Security Notes​

Next Steps​