Managing API Keys in WebReports

An API key is a credential that an application uses to authenticate to supported WebReports services. The API Keys page creates and manages keys for Report Designer and Management API clients, including their allowed hosts and access permissions.

Use a separate, clearly named key for an authorized client so administrators can identify its owner, review its access, and remove it when the integration is retired. A Report Designer key uses a selected Publisher user; a Management API key has explicit operation permissions.

WebReports keys and OpenAI keys are different: This page manages credentials for WebReports clients. It does not create or configure the OpenAI API key used by Bridgit AI. For Bridgit credentials, see Configuring Application Settings in WebReports.

Viewer access to Bridgit AI requires the Bridgit Analysis or Admin role. A WebReports API key or the API role is separate from this viewer access. See Understanding Default Roles and Permissions in WebReports.

Open API Keys

1. Sign in to WebReports with an administrator account.
2. Expand Configuration in the left navigation.
3. Select API Keys.

Screenshots use fictional demo data. Example settings are not recommended values or a statement of the defaults. Select an image to view its full size.

Fictional Demo Report Designer and Demo Integration keys with restricted example hosts.

Find an existing key

Use the search field to match a name, type, user, description, permission, or allowed host. Use column filters to narrow a specific field and column headings to sort. Select a row before choosing Edit or Delete. The list can include existing Legacy compatibility keys; the Add dialog offers Report Designer and Management API for new keys.

Create a Report Designer key

1. Select Add.
2. Enter an Application Name that identifies the client.
3. Set Key Type to Report Designer.
4. Select the Publisher User whose publishing access applies to the client.
5. Enter a useful description and the permitted host names or IP addresses. Separate multiple hosts with semicolons.
6. Securely copy the generated secret before closing the dialog. The dialog states that this is the only time the secret is shown.
7. Review the settings, then select Add API Key.

Report Designer key example using Demo Report Designer, demo.admin@example.com, and demo-designer.example.com; the secret is a nonworking placeholder.

Create a Management API key

1. Select Add, enter an Application Name, and choose Management API.
2. Enter the description and permitted hosts or IP addresses.
3. Select only the operation permissions needed by the integration.
4. Securely copy the generated secret, review the settings, and select Add API Key.

Management API example for Demo Integration with Queue Reports and View Completed Reports selected; the secret is a nonworking placeholder.

For example, a client that submits a report and retrieves its output may require Queue Reports and View Completed Reports, without user-management permissions. Determine the exact permissions from the operations the client uses; the screenshot is an example, not a complete integration specification.

Maintain or remove a key

1. Select the key and choose Edit.
2. Review the available fields, allowed hosts, and permissions. Existing-key dialogs can differ by key type and do not redisplay the original secret.
3. Select Update to save, then test the client’s required operation.
4. To retire the key, verify that no required client still uses it, select the key, and choose Delete. Follow any confirmation shown.

Store the secret in protected application configuration or a credential manager. If it is exposed or lost, arrange a replacement and update the client. Copying the secret is separate from creating the key. Do not use the nonworking demonstration secret shown in these images.