Skip to main content

How to Manage and Create Access Keys (API KEY) in Blip

  • Updated

  1. Overview

  2. How to create a new access key

  3. Authentication Types

  4. Default Key Rules and HTTP Configuration

  5. Deleting an access key

  6. Security Best Practices 

 

Overview

The purpose of this documentation is to instruct users on the complete process for managing access keys (API keys) on the platform. This article details how to create new keys, identify authentication types (HTTP and SDK), configure the default key, delete keys, and follow security best practices for maintaining credentials 

Before you begin

To perform the procedures below, make sure that the following requirements are met:

  • Only chatbot administrator users will have access to this feature.

  • Access key creation is limited to a maximum of 3 active keys at a time per bot.

  • For the chatbot to function correctly, it is mandatory to have a default access key. When you create a new chatbot, this default key is generated automatically.

 

How to create a new access key 

Follow the steps below carefully to create a new Authorization (API key) in your bot: 

  1. Go to the blip.ai portal and select the desired bot;

  2. After the interface loads, click your bot's name and select Settings;

  3. Then, select Access keys;

  4. Click the New key button;

  5. In the ‘Name’ field, add a name of your choice to identify the new key;

  6. Select ‘Create’;

  7. After clicking the Create button, a new screen will be displayed showing the information for the newly generated key;

  8. On this screen, you can view your new key in HTTP or SDK format. The access key is displayed only once when it is created:

  1. Store this information in a secure location, as you will not be able to view or recover it later for security reasons. Never share your key in an unprotected manner;

  2. After completion, a reference to this key will be displayed on the main key management screen, allowing you to view the ID or remove the key by selecting the trash can icon:


 

Authentication Types

When generating the credentials, you will notice two different formats available:

  • SDK format: Used for projects integrated through an SDK. Examples include Blip C# SDK, Blip Javascript SDK, Blip Python SDK, or Lime SDK.

  • HTTP format: Used in the (Authorization) header of an HTTP request, such as integrations or HTTP requests made directly to Blip.

To learn more about the authentication types (SDK and HTTP), see the technical documentation at https://docs.blip.ai/#authentication 

 

Default Key Rules and HTTP Configuration

  • Default Key: A key marked as default cannot be deleted, and its deletion is not allowed directly. To change the default key, create a new key. The most recently generated key will then automatically become the default.

  • HTTP Configuration: To change the bot's HTTP configuration on the platform, you must provide your SDK key. This requirement increases the security of who can change this sensitive information about your chatbot.

 

Deleting an access key

Before deleting a key, make sure that there are no integrations using the key you want to delete. The key cannot be in use by any integration in order to be deleted. 

If all keys are in use and you want to delete them, you must first create a new key, update all external integrations to use it, and only then delete the old keys.

To delete a key, follow these steps:

  1. On the key management screen, identify the credential that is not in use and click the trash can icon next to it.

  2. The system will request a security verification. Confirm the deletion by clicking the Delete button.

  3. A "Key successfully deleted" message will be displayed in the interface, formally completing the deletion process.


 

Security Best Practices

To ensure the integrity of your chatbot, strictly follow these security guidelines:

  • Change the security key periodically: As a security measure, we recommend changing the access key periodically (for example, every 6 months). Because the key does not expire, if it is obtained improperly, it could be misused indefinitely until it is deactivated on the platform.

  • Store the key in a secure location: Do not store the access key in a public location. Store the generated key in a secure location, such as a password vault or privileged access management system and, preferably, in systems that provide access management for saved information.

  • Sharing the access key: Only do this if you fully trust the application or person with whom you will share the information. When sharing the access key, use a secure method for transmitting this information, such as a password vault or privileged access management system with access management.

  • Do not leave the key in code: Do not include the access key directly in your application code. You should keep secrets separate from your code by storing them, for example, in specific configuration files or environment variables.

 

Need more help? Explore our content at Blip Academy or Blip Community, watch tutorials on our YouTube channel or get your questions answered through our support channel 😃

Related articles