Docs/Administration/API Keys

API Keys

Create, list, and revoke workspace API keys for the Celiq REST API from Lumen, with one-time raw-key reveal at creation.

LuminaryUpdated June 2026 · 5 min read

✦

In this section

Part of Celiq's semantic layer platform. Connect your warehouse, model your data once, query it everywhere.

💡

Tip

What it is — The panel where you mint and manage API keys that let external integrations call the Celiq REST API on behalf of your workspace.
When to use it — When you are wiring up a script, service, or third-party tool that needs programmatic access to your workspace's reports, nodes, and queries.
Where to find it — Lumen → API Keys.
Who can use it — Luminary (admin) only. Creating and revoking keys is credential provisioning and is restricted to admins.

API keys are long-lived credentials scoped to a single workspace. Each key authenticates calls to the Celiq public REST API instead of a signed-in user session. Because a key carries workspace access, only a Luminary can create or revoke one.

When you create a key, Celiq shows you the full secret value exactly once. After that, only a short prefix is ever displayed again — the full key cannot be retrieved, so you must copy and store it at the moment of creation.

Overview

The API Keys panel lists every key that exists in your workspace and gives you two actions: create a new key and revoke an existing one.

Each key in the table shows:

Name — the label you gave the key, so you can tell integrations apart.
Prefix — the first 8 characters of the raw key followed by an ellipsis (for example a1b2c3d4…). This is the only part of the key Celiq ever shows after creation.
Last Used — the date the key was last accepted on an API call, or Never if it has not yet been used.

When you create a key, a confirmation panel reveals the full secret value in monospace. Copy it immediately. Once you dismiss that panel, the value is gone for good.

When to use it

Create an API key when you need a non-interactive, programmatic caller to reach your workspace data — for example a scheduled export job, a backend service, or a spreadsheet integration. Use a separate, clearly named key per integration so you can revoke one without breaking the others.

Do not create an API key for a human who can simply sign in to Celiq. Interactive users authenticate through the normal sign-in flow described in Authentication; API keys are for machines.

Concepts

Term	What it means
Raw key	The full secret value, generated as 64 random hex characters. Shown only once, at creation. This is the value your integration sends on each request.
Key hash	What Celiq actually stores. The raw key is hashed with SHA-256 before it is saved; the original value is never written to the database.
Prefix	The first 8 characters of the raw key, stored in clear so you can recognize a key in the list. It is not enough to authenticate with.
Last used	A timestamp updated when a key is accepted on an API call. Useful for spotting keys that are no longer in use.
Revoke	Permanently deleting a key so it can no longer authenticate. There is no undo.

Getting started

Before you start, confirm you are signed in as a Luminary. The create and revoke actions are admin-only; other roles will not be able to mint or remove keys.

To open the panel, go to Lumen → API Keys. The page loads the list of existing keys for your current workspace. If the workspace has no keys yet, you will see an empty state inviting you to create one.

Step-by-step

Open the API Keys panel

In Lumen, select API Keys from the navigation. The existing keys for your workspace load into the table.

Start a new key

Click New Key in the top right. A Create API Key dialog opens.

Name the key

Enter a descriptive Name that identifies the integration, for example Production Read Key. A name is required.

Create the key

Click Create Key. Celiq generates the key, hashes it for storage, and returns the raw value to you.

Copy the raw key now

A confirmation panel appears with the full key in monospace and the message that it will never be shown again. Click Copy key, paste it into your integration's secret store, then confirm with I've saved it. The new key now appears in the table with its prefix.

Revoke a key when it is no longer needed

In the table row, click Revoke. Confirm in the dialog. Any integration still using that key stops working immediately, and the action cannot be undone.

Examples

A typical lifecycle: a data engineer needs a scheduled job to pull workspace reports nightly.

The Luminary opens Lumen → API Keys and clicks New Key.
They name it Nightly Export Job and click Create Key.
The reveal panel shows a value like the one below. They copy it into the job's secret manager and click I've saved it.

Key created — copy it now. It won't be shown again.
a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2

From then on, the panel shows only the prefix:

Name	Prefix	Last Used
Nightly Export Job	`a1b2c3d4…`	Never

After the first successful nightly run, Last Used updates to that date, confirming the integration is authenticating with the key.

Months later, when the job is retired, the Luminary clicks Revoke on that row to delete the key.

Best practices

One key per integration. Separate keys let you revoke a single integration without disrupting others.
Name keys for their purpose. A clear name like BI Sync — Production is far easier to manage than key1.
Store the raw key in a secret manager immediately. It is shown only at creation and cannot be recovered.
Review the Last Used column periodically. A key that shows Never long after creation, or one that has stopped updating, is a candidate for revocation.
Revoke promptly. When an integration is decommissioned or a key may have leaked, revoke it right away — revocation takes effect immediately.

Tips

💡

Tip

The prefix shown in the list is intentionally not enough to authenticate — it exists only so you can match a row to the integration you named. If you lose the full key, you cannot retrieve it from Celiq; create a new one and revoke the old.

Common mistakes

⚠️

Warning

Dismissing the reveal panel before copying the key. Once you close the one-time reveal, the full value is gone — Celiq stores only a SHA-256 hash, never the original. If this happens, revoke the unusable key and create a new one.

Sharing one key across many integrations. Revoking it to fix one integration silently breaks all the others. Mint a separate key per consumer.

Trying to create or revoke keys as a non-admin. Both actions are Luminary-only. If the buttons do not work for you, check your role under Users and Roles.

Troubleshooting

Symptom	Cause	Fix
Clicking Create Key does nothing	The Name field is empty; a name is required.	Enter a name, then click Create Key.
Create or revoke fails with a permission error	You are signed in as a non-admin role. Minting and revoking keys is restricted to Luminary.	Have a Luminary perform the action, or get your role changed under Users.
You closed the reveal panel without copying the key	The full key is shown only once and is stored only as a hash, so it cannot be recovered.	Revoke the unusable key and create a new one.
Revoke shows "API key not found"	The key was already deleted, or it belongs to a different workspace.	Refresh the panel; the list reflects only your current workspace's keys.
An integration suddenly stops authenticating	The key was revoked, or it never authenticated (Last Used shows Never).	Check whether the key still appears in the list; if it was revoked, create and configure a replacement.

Per-user keys (audit only)

Separately from this workspace panel, Lumen → Users shows a read-only list of API keys associated with an individual user. That view is for auditing — it surfaces a user's keys with their name, prefix, scopes, status, and last-used timestamp so an admin can review them. You create and revoke keys from the API Keys panel described here, not from the Users view.